Changed the permission the Learning Object Repository API checks against to be the read permission of the profile page (i.e. any non-guest can use it), and added the odd mimetype of "application/vnd.ms-office", because our staging server at least seems to think all office files are the mimetype.