Fix permissions being skipped in auth URL

Passing permissions when attempting to construct an auth URL would be
skipped always.

This uses the default permissions if none provided, but respects the
ones passed in directly.  Also allows you to pass an array or string.