I sorted it out.  The fix was (config)#event manager session cli username USER.  

This was a great find for me. Its a common problem for staff members to disable authentication and never turn it back on.  Anyhow,When I execute this, it matches every interface. The only thing I see that might be wrong is I get command authorization...