Privilege checks should be case-insensitive

We've had some instances where privileges were not named with consistent casing. (see EA-145) Although this was an oversight, we really should make privilege checks case-insensitive to avoid this issue.

(Side note: would also be good to check what is happening in any client-side utility methods to check a user's privilege)