moved privilege check out of getRecentReplies

it was being called twice in api/home