bugfix: for setting request privs on a user