add in stub permissions endpoint and clean up uri formation
check for global leaks and fix one instance of them in tests