add set_privacy for annotations of SubmissionStatus objects, plus tests
repaired failing tests (test_ACL and test_login)