Added custom privileges to SecurityMetadata and modified EmrExternalUrlInterceptor to check for one of those rather than for super-user status