fix permission issue on phonebook rest api