Added text/comma-separated-values to whitelist
Bugfix: parameter permissions is used instead of hardcoded READ permission