At some point I refactored to an API that doesn't require any permissions at all but never removed the permissions check. This corrects that