make on/off permissions turn web API on and off