Fix incorrect use of publish permissions for read permissions.

This one bit us pretty hard, as we pass the auth token from the app to our server to expedite signup, and new auth tokens had insufficient permissions because the requested read permissions had been dropped entirely.

(I now see that #504 made a similar change; but missed an instance and included an unrelated patch).