authorizationClient should allow root to see stuff as well
/access instead of /permissions