Fix permissions on AppAction to allow client-side auth.