actually check allowed permissions on oauth token