Expose permissions to client; Fix 403 error.