fixes #5612 - use correct permissions for authz in parameters API