moved privilege look up to user session