fix rest_api_permissions