set default permission class to HasAccessToken