Check privilege when checking Session ID.

[ranganathanm]

currently checkSessionId does not check privilege. Thus a user can acquire a session id and perform admin functions. This is a security hole. Solution is to add a "privilege" (i.e. "user" or "admin") to each flask entry point. When the session ID is checked, we need to check this privilege field as well.

[jkubNTIA]

Good point. Since the privilege is in the first part of the sessionID, this would be really easy to check.

[ranganathanm]

Fixed in ca4cfb6..396abb9