fix rest permission issues