it's confusing that can_openclose is the permission being used.  we do define a pin/unpin permission - does it ever make it through to the frontend?