Fix permission handling issues in REST views (OMS-330)