More API permission tests + redirect perms.