rest urls are working now with appropriate permissions