use access_privileges_attributes in POST for guests