check privs on composer.push