s4-lsasrv: make sure only admins can alter privileges