Made privacy automatic, relying on Session::$user.