X-Access-Token added to permission