Add privilege information to api headers