xAuth actually needs x_auth_permission header sometimes as per Vimeo API Reference