diff --git a/src/applications/audit/controller/PhabricatorAuditListController.php b/src/applications/audit/controller/PhabricatorAuditListController.php
--- a/src/applications/audit/controller/PhabricatorAuditListController.php
+++ b/src/applications/audit/controller/PhabricatorAuditListController.php
@@ -144,6 +144,7 @@
 
       $form->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->getRequest()->getUser())
           ->setName('set_phid')
           ->setLabel($label)
           ->setLimit(1)
diff --git a/src/applications/calendar/query/PhabricatorCalendarEventSearchEngine.php b/src/applications/calendar/query/PhabricatorCalendarEventSearchEngine.php
--- a/src/applications/calendar/query/PhabricatorCalendarEventSearchEngine.php
+++ b/src/applications/calendar/query/PhabricatorCalendarEventSearchEngine.php
@@ -98,12 +98,14 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/accounts/')
           ->setName('creators')
           ->setLabel(pht('Created By'))
           ->setValue($creator_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/accounts/')
           ->setName('invited')
           ->setLabel(pht('Invited'))
diff --git a/src/applications/conpherence/controller/ConpherenceNewController.php b/src/applications/conpherence/controller/ConpherenceNewController.php
--- a/src/applications/conpherence/controller/ConpherenceNewController.php
+++ b/src/applications/conpherence/controller/ConpherenceNewController.php
@@ -82,18 +82,19 @@
       ->setFullWidth(true)
       ->appendChild(
         id(new AphrontFormTokenizerControl())
-        ->setName('participants')
-        ->setValue($participant_handles)
-        ->setUser($user)
-        ->setDatasource('/typeahead/common/users/')
-        ->setLabel(pht('To'))
-        ->setError($e_participants))
+          ->setUser($user)
+          ->setName('participants')
+          ->setValue($participant_handles)
+          ->setUser($user)
+          ->setDatasource('/typeahead/common/users/')
+          ->setLabel(pht('To'))
+          ->setError($e_participants))
       ->appendChild(
         id(new PhabricatorRemarkupControl())
-        ->setName('message')
-        ->setValue($message)
-        ->setLabel(pht('Message'))
-        ->setError($e_message));
+          ->setName('message')
+          ->setValue($message)
+          ->setLabel(pht('Message'))
+          ->setError($e_message));
 
     $dialog->appendChild($form);
 
diff --git a/src/applications/conpherence/controller/ConpherenceUpdateController.php b/src/applications/conpherence/controller/ConpherenceUpdateController.php
--- a/src/applications/conpherence/controller/ConpherenceUpdateController.php
+++ b/src/applications/conpherence/controller/ConpherenceUpdateController.php
@@ -186,9 +186,9 @@
       ->setFullWidth(true)
       ->appendChild(
         id(new AphrontFormTokenizerControl())
-        ->setName('add_person')
-        ->setUser($user)
-        ->setDatasource('/typeahead/common/users/'));
+          ->setName('add_person')
+          ->setUser($user)
+          ->setDatasource('/typeahead/common/users/'));
 
     require_celerity_resource('conpherence-update-css');
     return id(new AphrontDialogView())
diff --git a/src/applications/countdown/query/PhabricatorCountdownSearchEngine.php b/src/applications/countdown/query/PhabricatorCountdownSearchEngine.php
--- a/src/applications/countdown/query/PhabricatorCountdownSearchEngine.php
+++ b/src/applications/countdown/query/PhabricatorCountdownSearchEngine.php
@@ -43,6 +43,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
diff --git a/src/applications/differential/field/specification/DifferentialCCsFieldSpecification.php b/src/applications/differential/field/specification/DifferentialCCsFieldSpecification.php
--- a/src/applications/differential/field/specification/DifferentialCCsFieldSpecification.php
+++ b/src/applications/differential/field/specification/DifferentialCCsFieldSpecification.php
@@ -53,6 +53,7 @@
       $cc_map[] = $this->getHandle($phid);
     }
     return id(new AphrontFormTokenizerControl())
+      ->setUser(new PhabricatorUser())
       ->setLabel('CC')
       ->setName('cc')
       ->setUser($this->getUser())
diff --git a/src/applications/differential/field/specification/DifferentialRepositoryFieldSpecification.php b/src/applications/differential/field/specification/DifferentialRepositoryFieldSpecification.php
--- a/src/applications/differential/field/specification/DifferentialRepositoryFieldSpecification.php
+++ b/src/applications/differential/field/specification/DifferentialRepositoryFieldSpecification.php
@@ -33,6 +33,7 @@
     }
 
     return id(new AphrontFormTokenizerControl())
+      ->setUser(new PhabricatorUser())
       ->setLabel('Repository')
       ->setName('repositoryPHID')
       ->setUser($this->getUser())
diff --git a/src/applications/differential/field/specification/DifferentialReviewersFieldSpecification.php b/src/applications/differential/field/specification/DifferentialReviewersFieldSpecification.php
--- a/src/applications/differential/field/specification/DifferentialReviewersFieldSpecification.php
+++ b/src/applications/differential/field/specification/DifferentialReviewersFieldSpecification.php
@@ -92,6 +92,7 @@
       $reviewer_map[] = $this->getHandle($phid);
     }
     return id(new AphrontFormTokenizerControl())
+      ->setUser(new PhabricatorUser())
       ->setLabel(pht('Reviewers'))
       ->setName('reviewers')
       ->setUser($this->getUser())
diff --git a/src/applications/differential/query/DifferentialRevisionSearchEngine.php b/src/applications/differential/query/DifferentialRevisionSearchEngine.php
--- a/src/applications/differential/query/DifferentialRevisionSearchEngine.php
+++ b/src/applications/differential/query/DifferentialRevisionSearchEngine.php
@@ -128,33 +128,40 @@
       ->withPHIDs($all_phids)
       ->execute();
 
+    $viewer = $this->requireViewer();
+
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($viewer)
           ->setLabel(pht('Responsible Users'))
           ->setName('responsibles')
           ->setDatasource('/typeahead/common/accounts/')
           ->setValue(array_select_keys($handles, $responsible_phids)))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($viewer)
           ->setLabel(pht('Authors'))
           ->setName('authors')
           ->setDatasource('/typeahead/common/accounts/')
           ->setValue(array_select_keys($handles, $author_phids)))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($viewer)
           ->setLabel(pht('Reviewers'))
           ->setName('reviewers')
           ->setDatasource('/typeahead/common/accountsorprojects/')
           ->setValue(array_select_keys($handles, $reviewer_phids)))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($viewer)
           ->setLabel(pht('Subscribers'))
           ->setName('subscribers')
           ->setDatasource('/typeahead/common/allmailable/')
           ->setValue(array_select_keys($handles, $subscriber_phids)))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($viewer)
           ->setLabel(pht('Repositories'))
           ->setName('repositories')
           ->setDatasource('/typeahead/common/repositories/')
diff --git a/src/applications/differential/view/DifferentialAddCommentView.php b/src/applications/differential/view/DifferentialAddCommentView.php
--- a/src/applications/differential/view/DifferentialAddCommentView.php
+++ b/src/applications/differential/view/DifferentialAddCommentView.php
@@ -82,6 +82,7 @@
           ->setOptions($this->actions))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser(new PhabricatorUser())
           ->setLabel($enable_reviewers ? $add_reviewers_labels[$action] :
             $add_reviewers_labels['add_reviewers'])
           ->setName('reviewers')
@@ -91,6 +92,7 @@
           ->setDisableBehavior(true))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser(new PhabricatorUser())
           ->setLabel(pht('Add CCs'))
           ->setName('ccs')
           ->setControlID('add-ccs')
diff --git a/src/applications/diffusion/controller/DiffusionCommitController.php b/src/applications/diffusion/controller/DiffusionCommitController.php
--- a/src/applications/diffusion/controller/DiffusionCommitController.php
+++ b/src/applications/diffusion/controller/DiffusionCommitController.php
@@ -741,6 +741,7 @@
           ->setOptions($actions))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel(pht('Add Auditors'))
           ->setName('auditors')
           ->setControlID('add-auditors')
@@ -749,6 +750,7 @@
           ->setDisableBehavior(true))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel(pht('Add CCs'))
           ->setName('ccs')
           ->setControlID('add-ccs')
diff --git a/src/applications/diffusion/controller/DiffusionCommitEditController.php b/src/applications/diffusion/controller/DiffusionCommitEditController.php
--- a/src/applications/diffusion/controller/DiffusionCommitEditController.php
+++ b/src/applications/diffusion/controller/DiffusionCommitEditController.php
@@ -57,20 +57,21 @@
       ->setAction($request->getRequestURI()->getPath())
       ->appendChild(
         id(new AphrontFormTokenizerControl())
-        ->setLabel(pht('Projects'))
-        ->setName('projects')
-        ->setValue($proj_t_values)
-        ->setID($tokenizer_id)
-        ->setCaption(
-          javelin_tag(
-            'a',
-            array(
-              'href'        => '/project/create/',
-              'mustcapture' => true,
-              'sigil'       => 'project-create',
-            ),
-            pht('Create New Project')))
-        ->setDatasource('/typeahead/common/projects/'));;
+          ->setUser($user)
+          ->setLabel(pht('Projects'))
+          ->setName('projects')
+          ->setValue($proj_t_values)
+          ->setID($tokenizer_id)
+          ->setCaption(
+            javelin_tag(
+              'a',
+              array(
+                'href'        => '/project/create/',
+                'mustcapture' => true,
+                'sigil'       => 'project-create',
+              ),
+              pht('Create New Project')))
+          ->setDatasource('/typeahead/common/projects/'));;
 
     Javelin::initBehavior('project-create', array(
       'tokenizerID' => $tokenizer_id,
diff --git a/src/applications/diffusion/controller/DiffusionLintController.php b/src/applications/diffusion/controller/DiffusionLintController.php
--- a/src/applications/diffusion/controller/DiffusionLintController.php
+++ b/src/applications/diffusion/controller/DiffusionLintController.php
@@ -112,6 +112,7 @@
         ->setMethod('GET')
         ->appendChild(
           id(new AphrontFormTokenizerControl())
+            ->setUser($user)
             ->setDatasource('/typeahead/common/users/')
             ->setLimit(1)
             ->setName('owner')
diff --git a/src/applications/diffusion/controller/DiffusionRepositoryEditBasicController.php b/src/applications/diffusion/controller/DiffusionRepositoryEditBasicController.php
--- a/src/applications/diffusion/controller/DiffusionRepositoryEditBasicController.php
+++ b/src/applications/diffusion/controller/DiffusionRepositoryEditBasicController.php
@@ -116,6 +116,7 @@
           ->setValue($v_desc))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setDatasource('/typeahead/common/projects/')
           ->setName('projectPHIDs')
           ->setLabel(pht('Projects'))
diff --git a/src/applications/feed/query/PhabricatorFeedSearchEngine.php b/src/applications/feed/query/PhabricatorFeedSearchEngine.php
--- a/src/applications/feed/query/PhabricatorFeedSearchEngine.php
+++ b/src/applications/feed/query/PhabricatorFeedSearchEngine.php
@@ -74,12 +74,14 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('users')
           ->setLabel(pht('Include Users'))
           ->setValue($user_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/projects/')
           ->setName('projectPHIDs')
           ->setLabel(pht('Include Projects'))
diff --git a/src/applications/files/query/PhabricatorFileSearchEngine.php b/src/applications/files/query/PhabricatorFileSearchEngine.php
--- a/src/applications/files/query/PhabricatorFileSearchEngine.php
+++ b/src/applications/files/query/PhabricatorFileSearchEngine.php
@@ -56,6 +56,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
diff --git a/src/applications/herald/query/HeraldRuleSearchEngine.php b/src/applications/herald/query/HeraldRuleSearchEngine.php
--- a/src/applications/herald/query/HeraldRuleSearchEngine.php
+++ b/src/applications/herald/query/HeraldRuleSearchEngine.php
@@ -63,6 +63,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
diff --git a/src/applications/legalpad/query/LegalpadDocumentSearchEngine.php b/src/applications/legalpad/query/LegalpadDocumentSearchEngine.php
--- a/src/applications/legalpad/query/LegalpadDocumentSearchEngine.php
+++ b/src/applications/legalpad/query/LegalpadDocumentSearchEngine.php
@@ -57,12 +57,14 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('creators')
           ->setLabel(pht('Creators'))
           ->setValue(array_select_keys($handles, $creator_phids)))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('contributors')
           ->setLabel(pht('Contributors'))
diff --git a/src/applications/macro/controller/PhabricatorMacroMemeDialogController.php b/src/applications/macro/controller/PhabricatorMacroMemeDialogController.php
--- a/src/applications/macro/controller/PhabricatorMacroMemeDialogController.php
+++ b/src/applications/macro/controller/PhabricatorMacroMemeDialogController.php
@@ -47,6 +47,7 @@
     $view = id(new PHUIFormLayoutView())
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel(pht('Macro'))
           ->setName('macro')
           ->setLimit(1)
diff --git a/src/applications/macro/query/PhabricatorMacroSearchEngine.php b/src/applications/macro/query/PhabricatorMacroSearchEngine.php
--- a/src/applications/macro/query/PhabricatorMacroSearchEngine.php
+++ b/src/applications/macro/query/PhabricatorMacroSearchEngine.php
@@ -85,6 +85,7 @@
           ->setValue($status))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
diff --git a/src/applications/maniphest/controller/ManiphestReportController.php b/src/applications/maniphest/controller/ManiphestReportController.php
--- a/src/applications/maniphest/controller/ManiphestReportController.php
+++ b/src/applications/maniphest/controller/ManiphestReportController.php
@@ -308,6 +308,7 @@
       ->setUser($user)
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setDatasource('/typeahead/common/searchproject/')
           ->setLabel(pht('Project'))
           ->setLimit(1)
diff --git a/src/applications/maniphest/controller/ManiphestTaskDetailController.php b/src/applications/maniphest/controller/ManiphestTaskDetailController.php
--- a/src/applications/maniphest/controller/ManiphestTaskDetailController.php
+++ b/src/applications/maniphest/controller/ManiphestTaskDetailController.php
@@ -248,6 +248,7 @@
           ->setOptions($resolution_types))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel(pht('Assign To'))
           ->setName('assign_to')
           ->setControlID('assign_to')
@@ -256,6 +257,7 @@
           ->setDisableBehavior(true))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel(pht('CCs'))
           ->setName('ccs')
           ->setControlID('ccs')
@@ -272,6 +274,7 @@
           ->setValue($task->getPriority()))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel(pht('Projects'))
           ->setName('projects')
           ->setControlID('projects')
diff --git a/src/applications/maniphest/controller/ManiphestTaskEditController.php b/src/applications/maniphest/controller/ManiphestTaskEditController.php
--- a/src/applications/maniphest/controller/ManiphestTaskEditController.php
+++ b/src/applications/maniphest/controller/ManiphestTaskEditController.php
@@ -561,6 +561,7 @@
       $form
         ->appendChild(
           id(new AphrontFormTokenizerControl())
+            ->setUser($user)
             ->setLabel(pht('Projects'))
             ->setName('projects')
             ->setValue($projects_value)
diff --git a/src/applications/maniphest/query/ManiphestTaskSearchEngine.php b/src/applications/maniphest/query/ManiphestTaskSearchEngine.php
--- a/src/applications/maniphest/query/ManiphestTaskSearchEngine.php
+++ b/src/applications/maniphest/query/ManiphestTaskSearchEngine.php
@@ -255,6 +255,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/accounts/')
           ->setName('assigned')
           ->setLabel(pht('Assigned To'))
@@ -268,6 +269,7 @@
             $with_unassigned))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/projects/')
           ->setName('allProjects')
           ->setLabel(pht('In All Projects'))
@@ -281,30 +283,35 @@
             $with_no_projects))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/projects/')
           ->setName('anyProjects')
           ->setLabel(pht('In Any Project'))
           ->setValue($any_project_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/projects/')
           ->setName('excludeProjects')
           ->setLabel(pht('Not In Projects'))
           ->setValue($exclude_project_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/accounts/')
           ->setName('userProjects')
           ->setLabel(pht('In Users\' Projects'))
           ->setValue($user_project_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/accounts/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
           ->setValue($author_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/mailable/')
           ->setName('subscribers')
           ->setLabel(pht('Subscribers'))
diff --git a/src/applications/owners/controller/PhabricatorOwnersEditController.php b/src/applications/owners/controller/PhabricatorOwnersEditController.php
--- a/src/applications/owners/controller/PhabricatorOwnersEditController.php
+++ b/src/applications/owners/controller/PhabricatorOwnersEditController.php
@@ -181,6 +181,7 @@
           ->setError($e_name))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setDatasource('/typeahead/common/usersorprojects/')
           ->setLabel(pht('Primary Owner'))
           ->setName('primary')
@@ -189,6 +190,7 @@
           ->setError($e_primary))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setDatasource('/typeahead/common/usersorprojects/')
           ->setLabel(pht('Owners'))
           ->setName('owners')
diff --git a/src/applications/owners/controller/PhabricatorOwnersListController.php b/src/applications/owners/controller/PhabricatorOwnersListController.php
--- a/src/applications/owners/controller/PhabricatorOwnersListController.php
+++ b/src/applications/owners/controller/PhabricatorOwnersListController.php
@@ -177,6 +177,7 @@
           ->setValue($request->getStr('name')))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setDatasource('/typeahead/common/usersorprojects/')
           ->setLimit(1)
           ->setName('owner')
diff --git a/src/applications/paste/query/PhabricatorPasteSearchEngine.php b/src/applications/paste/query/PhabricatorPasteSearchEngine.php
--- a/src/applications/paste/query/PhabricatorPasteSearchEngine.php
+++ b/src/applications/paste/query/PhabricatorPasteSearchEngine.php
@@ -66,6 +66,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
diff --git a/src/applications/people/controller/PhabricatorPeopleLogsController.php b/src/applications/people/controller/PhabricatorPeopleLogsController.php
--- a/src/applications/people/controller/PhabricatorPeopleLogsController.php
+++ b/src/applications/people/controller/PhabricatorPeopleLogsController.php
@@ -36,6 +36,7 @@
       ->setUser($user)
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel(pht('Filter Actor'))
           ->setName('actor')
           ->setLimit(1)
@@ -43,6 +44,7 @@
           ->setDatasource('/typeahead/common/accounts/'))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel(pht('Filter User'))
           ->setName('user')
           ->setLimit(1)
diff --git a/src/applications/pholio/controller/PholioMockEditController.php b/src/applications/pholio/controller/PholioMockEditController.php
--- a/src/applications/pholio/controller/PholioMockEditController.php
+++ b/src/applications/pholio/controller/PholioMockEditController.php
@@ -288,37 +288,38 @@
       ->appendChild($order_control)
       ->appendChild(
         id(new AphrontFormTextControl())
-        ->setName('name')
-        ->setValue($v_name)
-        ->setLabel(pht('Name'))
-        ->setError($e_name))
+          ->setName('name')
+          ->setValue($v_name)
+          ->setLabel(pht('Name'))
+          ->setError($e_name))
       ->appendChild(
         id(new PhabricatorRemarkupControl())
-        ->setName('description')
-        ->setValue($v_desc)
-        ->setLabel(pht('Description'))
-        ->setUser($user))
+          ->setName('description')
+          ->setValue($v_desc)
+          ->setLabel(pht('Description'))
+          ->setUser($user))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
-        ->setLabel(pht('CC'))
-        ->setName('cc')
-        ->setValue($handles)
-        ->setUser($user)
-        ->setDatasource('/typeahead/common/mailable/'))
+          ->setUser($user)
+          ->setLabel(pht('CC'))
+          ->setName('cc')
+          ->setValue($handles)
+          ->setUser($user)
+          ->setDatasource('/typeahead/common/mailable/'))
       ->appendChild(
         id(new AphrontFormPolicyControl())
-        ->setUser($user)
-        ->setCapability(PhabricatorPolicyCapability::CAN_VIEW)
-        ->setPolicyObject($mock)
-        ->setPolicies($policies)
-        ->setName('can_view'))
+          ->setUser($user)
+          ->setCapability(PhabricatorPolicyCapability::CAN_VIEW)
+          ->setPolicyObject($mock)
+          ->setPolicies($policies)
+          ->setName('can_view'))
       ->appendChild(
         id(new AphrontFormMarkupControl())
-        ->setValue($list_control))
+          ->setValue($list_control))
       ->appendChild(
         id(new AphrontFormMarkupControl())
-        ->setValue($drop_control)
-        ->setError($e_images))
+          ->setValue($drop_control)
+          ->setError($e_images))
       ->appendChild($submit);
 
     $form_box = id(new PHUIObjectBoxView())
diff --git a/src/applications/pholio/query/PholioMockSearchEngine.php b/src/applications/pholio/query/PholioMockSearchEngine.php
--- a/src/applications/pholio/query/PholioMockSearchEngine.php
+++ b/src/applications/pholio/query/PholioMockSearchEngine.php
@@ -35,6 +35,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
diff --git a/src/applications/phrequent/query/PhrequentSearchEngine.php b/src/applications/phrequent/query/PhrequentSearchEngine.php
--- a/src/applications/phrequent/query/PhrequentSearchEngine.php
+++ b/src/applications/phrequent/query/PhrequentSearchEngine.php
@@ -61,6 +61,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('users')
           ->setLabel(pht('Users'))
diff --git a/src/applications/ponder/query/PonderQuestionSearchEngine.php b/src/applications/ponder/query/PonderQuestionSearchEngine.php
--- a/src/applications/ponder/query/PonderQuestionSearchEngine.php
+++ b/src/applications/ponder/query/PonderQuestionSearchEngine.php
@@ -65,12 +65,14 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
           ->setValue(array_select_keys($handles, $author_phids)))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('answerers')
           ->setLabel(pht('Answered By'))
diff --git a/src/applications/project/controller/PhabricatorProjectMembersEditController.php b/src/applications/project/controller/PhabricatorProjectMembersEditController.php
--- a/src/applications/project/controller/PhabricatorProjectMembersEditController.php
+++ b/src/applications/project/controller/PhabricatorProjectMembersEditController.php
@@ -83,6 +83,7 @@
       ->setUser($user)
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setName('phids')
           ->setLabel(pht('Add Members'))
           ->setDatasource('/typeahead/common/accounts/'))
diff --git a/src/applications/project/query/PhabricatorProjectSearchEngine.php b/src/applications/project/query/PhabricatorProjectSearchEngine.php
--- a/src/applications/project/query/PhabricatorProjectSearchEngine.php
+++ b/src/applications/project/query/PhabricatorProjectSearchEngine.php
@@ -54,6 +54,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('members')
           ->setLabel(pht('Members'))
diff --git a/src/applications/releeph/controller/project/ReleephProjectEditController.php b/src/applications/releeph/controller/project/ReleephProjectEditController.php
--- a/src/applications/releeph/controller/project/ReleephProjectEditController.php
+++ b/src/applications/releeph/controller/project/ReleephProjectEditController.php
@@ -202,6 +202,7 @@
         'is allowed to approve requests.'))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($request->getUser())
           ->setLabel(pht('Pushers'))
           ->setName('pushers')
           ->setDatasource('/typeahead/common/users/')
diff --git a/src/applications/releeph/query/ReleephRequestSearchEngine.php b/src/applications/releeph/query/ReleephRequestSearchEngine.php
--- a/src/applications/releeph/query/ReleephRequestSearchEngine.php
+++ b/src/applications/releeph/query/ReleephRequestSearchEngine.php
@@ -80,6 +80,7 @@
           ->setOptions($this->getSeverityOptions()))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('requestors')
           ->setLabel(pht('Requestors'))
diff --git a/src/applications/repository/controller/PhabricatorRepositoryArcanistProjectEditController.php b/src/applications/repository/controller/PhabricatorRepositoryArcanistProjectEditController.php
--- a/src/applications/repository/controller/PhabricatorRepositoryArcanistProjectEditController.php
+++ b/src/applications/repository/controller/PhabricatorRepositoryArcanistProjectEditController.php
@@ -93,6 +93,7 @@
           ->setValue($langs))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($user)
           ->setLabel('Uses Symbols From')
           ->setName('symbolIndexProjects')
           ->setDatasource('/typeahead/common/arcanistprojects/')
diff --git a/src/applications/repository/query/PhabricatorRepositoryPushLogSearchEngine.php b/src/applications/repository/query/PhabricatorRepositoryPushLogSearchEngine.php
--- a/src/applications/repository/query/PhabricatorRepositoryPushLogSearchEngine.php
+++ b/src/applications/repository/query/PhabricatorRepositoryPushLogSearchEngine.php
@@ -66,12 +66,14 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/repositories/')
           ->setName('repositories')
           ->setLabel(pht('Repositories'))
           ->setValue($repository_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/accounts/')
           ->setName('pushers')
           ->setLabel(pht('Pushers'))
diff --git a/src/applications/repository/query/PhabricatorRepositorySearchEngine.php b/src/applications/repository/query/PhabricatorRepositorySearchEngine.php
--- a/src/applications/repository/query/PhabricatorRepositorySearchEngine.php
+++ b/src/applications/repository/query/PhabricatorRepositorySearchEngine.php
@@ -98,6 +98,7 @@
           ->setValue($name))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/projects/')
           ->setName('anyProjects')
           ->setLabel(pht('In Any Project'))
diff --git a/src/applications/search/engine/PhabricatorApplicationSearchEngine.php b/src/applications/search/engine/PhabricatorApplicationSearchEngine.php
--- a/src/applications/search/engine/PhabricatorApplicationSearchEngine.php
+++ b/src/applications/search/engine/PhabricatorApplicationSearchEngine.php
@@ -22,7 +22,7 @@
     return $this;
   }
 
-  protected function requireViewer() {
+  public function requireViewer() {
     if (!$this->viewer) {
       throw new Exception("Call setViewer() before using an engine!");
     }
diff --git a/src/applications/search/query/PhabricatorSearchApplicationSearchEngine.php b/src/applications/search/query/PhabricatorSearchApplicationSearchEngine.php
--- a/src/applications/search/query/PhabricatorSearchApplicationSearchEngine.php
+++ b/src/applications/search/query/PhabricatorSearchApplicationSearchEngine.php
@@ -126,12 +126,14 @@
       ->appendChild($types_control)
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setName('authorPHIDs')
           ->setLabel('Authors')
           ->setDatasource('/typeahead/common/users/')
           ->setValue($author_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setName('ownerPHIDs')
           ->setLabel('Owners')
           ->setDatasource('/typeahead/common/searchowner/')
@@ -145,12 +147,14 @@
             $with_unowned))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setName('subscriberPHIDs')
           ->setLabel('Subscribers')
           ->setDatasource('/typeahead/common/users/')
           ->setValue($subscriber_handles))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setName('projectPHIDs')
           ->setLabel('In Any Project')
           ->setDatasource('/typeahead/common/projects/')
diff --git a/src/applications/slowvote/query/PhabricatorSlowvoteSearchEngine.php b/src/applications/slowvote/query/PhabricatorSlowvoteSearchEngine.php
--- a/src/applications/slowvote/query/PhabricatorSlowvoteSearchEngine.php
+++ b/src/applications/slowvote/query/PhabricatorSlowvoteSearchEngine.php
@@ -39,6 +39,7 @@
     $form
       ->appendChild(
         id(new AphrontFormTokenizerControl())
+          ->setUser($this->requireViewer())
           ->setDatasource('/typeahead/common/users/')
           ->setName('authors')
           ->setLabel(pht('Authors'))
diff --git a/src/infrastructure/customfield/standard/PhabricatorStandardCustomFieldUsers.php b/src/infrastructure/customfield/standard/PhabricatorStandardCustomFieldUsers.php
--- a/src/infrastructure/customfield/standard/PhabricatorStandardCustomFieldUsers.php
+++ b/src/infrastructure/customfield/standard/PhabricatorStandardCustomFieldUsers.php
@@ -21,6 +21,7 @@
     }
 
     $control = id(new AphrontFormTokenizerControl())
+      ->setUser($this->getViewer())
       ->setLabel($this->getFieldName())
       ->setName($this->getFieldKey())
       ->setDatasource('/typeahead/common/accounts/')
@@ -42,6 +43,7 @@
     array $handles) {
 
     $control = id(new AphrontFormTokenizerControl())
+      ->setUser($engine->requireViewer())
       ->setLabel($this->getFieldName())
       ->setName($this->getFieldKey())
       ->setDatasource('/typeahead/common/accounts/')
diff --git a/src/view/control/AphrontTokenizerTemplateView.php b/src/view/control/AphrontTokenizerTemplateView.php
--- a/src/view/control/AphrontTokenizerTemplateView.php
+++ b/src/view/control/AphrontTokenizerTemplateView.php
@@ -45,6 +45,12 @@
         $value->getTypeIcon());
     }
 
+    if ($this->getUser()) {
+      $username = $this->getUser()->getUsername();
+    } else {
+      $username = null;
+    }
+
     $input = javelin_tag(
       'input',
       array(
@@ -55,6 +61,7 @@
         'style'       => 'width: 0px;',
         'disabled'    => 'disabled',
         'type'        => 'text',
+        'username'    => $username,
       ));
 
     $content = $tokens;
diff --git a/src/view/form/control/AphrontFormTokenizerControl.php b/src/view/form/control/AphrontFormTokenizerControl.php
--- a/src/view/form/control/AphrontFormTokenizerControl.php
+++ b/src/view/form/control/AphrontFormTokenizerControl.php
@@ -32,6 +32,12 @@
   }
 
   protected function renderInput() {
+    if (!$this->getUser()) {
+      throw new Exception(
+        pht(
+          'Call setUser() before rendering an AphrontFormTokenizerControl.'));
+    }
+
     $name = $this->getName();
     $values = nonempty($this->getValue(), array());
 
@@ -52,11 +58,6 @@
     $template->setID($id);
     $template->setValue($values);
 
-    $username = null;
-    if ($this->user) {
-      $username = $this->user->getUsername();
-    }
-
     if (!$this->disableBehavior) {
       Javelin::initBehavior('aphront-basic-tokenizer', array(
         'id'          => $id,
@@ -64,7 +65,7 @@
         'value'       => mpull($values, 'getFullName', 'getPHID'),
         'icons'       => mpull($values, 'getTypeIcon', 'getPHID'),
         'limit'       => $this->limit,
-        'username'    => $username,
+        'username'    => $this->user->getUsername(),
         'placeholder' => $this->placeholder,
       ));
     }