fixes #2266 - API doesn't honor 'view_facts' permission