[client] Use userProfile instead of user to check privilege flags