add label array support to privilege_map.can?