SASL and content_filter

I want to tell a content_filter that an email arrived using SASL
authentication. I cannot figure out a way to do this. Is there a way?

Specifically, I want to tell amavis/spamassassin that it was SASL
authenticated, so that it can whitelist mail sent by local users - without
relying on the sender envelope since that can be forged. With the latest
snapshot it looks like I can add a header somehow, which might do the trick
for me; however that can also be forged.

Any suggestions?

Thanks,
Bill Boebel