add privilege checks to (un)set/show/bad* cmds