Fix privileges in settings and users screen

here it would be better to use some `_.find` first so it's obvious you're only changing 1 item. and it could be in it's own function