fix apiQuery @permissions = @control (ref: #493 and @494)