updated VCR cassette
refactor privilege grant methods
properly escape query parameters