changing lookup so private can only be used by service creds, etc. and non-private for other things like db filtering, data replacement.