733 media endpoint deals with permissions poorly

closes #733