fixed add/update student according to the privilege