bth: superuser can approve