fix token permissions