constrain the scope of the permissions API
Merge pull request #107 from w3c/hillbrad/PermissionsAPIScope

constrain the scope of the permissions API