fix permissions for files API

#6425