modify require_privilege to also check the user’s privileges

also raise Http404 when no matches can be found