const resp = await fetch(`/users/${$tgt.attr('data-user')}/mod/privileges`, {
      method: 'POST',
      body: JSON.stringify({ do: 'grant', ability: $tgt.attr('data-ability') }),
      headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': QPixel.csrfToken() },
      credentials: 'include'