revoke all previous privileges before granting