Why do matchpathcon and restorecon ignore the user context by default?