Fix permissions for POST