fix rest access permissions