some fixes for CheckTokenMembership: - properly create an impersonation token from the primary token in case the thread is not impersonating - use NtAccessCheck to perform the access check Updated files: trunk/reactos/lib/advapi32/token/token.c