security = good!

In addition to some long overdue securing of the routes (*cough*), you must pass the permissions object to aposPreferencesMenu. The docs always said so, but now it's a thing, so if you were not doing that, fix it.