all js access to user_privilege changed from _exists to hasOwnProperty