cleaner handling of host privileges