Use capabilities instead of deprecated user levels