Index: src/build.c
==================================================================
--- src/build.c
+++ src/build.c
@@ -153,10 +153,28 @@
   assert( !pParse->isMultiWrite 
        || sqlite3VdbeAssertMayAbort(v, pParse->mayAbort));
   if( v ){
     while( sqlite3VdbeDeletePriorOpcode(v, OP_Close) ){}
     sqlite3VdbeAddOp0(v, OP_Halt);
+
+#if SQLITE_USER_AUTHENTICATION
+    if( pParse->nTableLock>0 && db->init.busy==0 ){
+      if( db->auth.authLevel<UAUTH_User ){
+        if( db->auth.authLevel==UAUTH_Unknown ){
+          u8 authLevel = UAUTH_Fail;
+          sqlite3UserAuthCheckLogin(db, "main", &authLevel);
+          db->auth.authLevel = authLevel;
+          if( authLevel<UAUTH_Admin ) db->flags &= ~SQLITE_WriteSchema;
+        }
+        if( db->auth.authLevel<UAUTH_User ){
+          pParse->rc = SQLITE_AUTH_USER;
+          sqlite3ErrorMsg(pParse, "user not authenticated");
+          return;
+        }
+      }
+    }
+#endif
 
     /* The cookie mask contains one bit for each database file open.
     ** (Bit 0 is for main, bit 1 is for temp, and so forth.)  Bits are
     ** set for each database that is used.  Generate code to start a
     ** transaction on each used database and to verify the schema cookie

Index: src/pragma.c
==================================================================
--- src/pragma.c
+++ src/pragma.c
@@ -1396,11 +1396,11 @@
         /* Foreign key support may not be enabled or disabled while not
         ** in auto-commit mode.  */
         mask &= ~(SQLITE_ForeignKeys);
       }
 #if SQLITE_USER_AUTHENTICATION
-      if( db->auth.authLevel<UAUTH_Admin ){
+      if( db->auth.authLevel==UAUTH_User ){
         /* Do not allow non-admin users to modify the schema arbitrarily */
         mask &= ~(SQLITE_WriteSchema);
       }
 #endif
 

Index: src/prepare.c
==================================================================
--- src/prepare.c
+++ src/prepare.c
@@ -713,24 +713,10 @@
   *ppStmt = 0;
   if( !sqlite3SafetyCheckOk(db) ){
     return SQLITE_MISUSE_BKPT;
   }
   sqlite3_mutex_enter(db->mutex);
-#if SQLITE_USER_AUTHENTICATION
-  if( db->auth.authLevel<UAUTH_User ){
-    if( db->auth.authLevel==UAUTH_Unknown ){
-      u8 authLevel = UAUTH_Fail;
-      sqlite3UserAuthCheckLogin(db, "main", &authLevel);
-      db->auth.authLevel = authLevel;
-    }
-    if( db->auth.authLevel<UAUTH_User ){
-      sqlite3ErrorWithMsg(db, SQLITE_AUTH_USER, "user not authenticated");
-      sqlite3_mutex_leave(db->mutex);
-      return SQLITE_ERROR;
-    }
-  }
-#endif
   sqlite3BtreeEnterAll(db);
   rc = sqlite3Prepare(db, zSql, nBytes, saveSqlFlag, pOld, ppStmt, pzTail);
   if( rc==SQLITE_SCHEMA ){
     sqlite3_finalize(*ppStmt);
     rc = sqlite3Prepare(db, zSql, nBytes, saveSqlFlag, pOld, ppStmt, pzTail);