A network engineer configures a router to authenticate administrative logins against a RADIUS server. Users can log in successfully with their RADIUS credentials, but every user lands at privilege level 1 and cannot enter privileged EXEC mode even though the RADIUS server is configured to return a cisco-av-pair of 'shell:priv-lvl=15'. The relevant configuration includes 'aaa authentication login default group radius local' and 'line vty 0 4 / login authentication default'. Which configuration change will allow the returned privilege level to be applied automatically at login?