minor privilege checking and bug fixes for ajax commands