fix Graph API permissions