the "privileged" bit is in manifest.webapp in application.zip