Fix POST permissions