This was change in the MVC development model - you have two separate apps where in the front end apps you have everything under your control, including authentication. So, if you want to impersonate users on the live site, you need to implement this on your front end app.