add code to check privilege for some APIs