updates permissions support to also include tokens