diff --git a/editor/js/ui/deploy.js b/editor/js/ui/deploy.js
index 1c350f0ea..6d81c97ce 100644
--- a/editor/js/ui/deploy.js
+++ b/editor/js/ui/deploy.js
@@ -237,7 +237,7 @@ RED.deploy = (function() {
             }).fail(function(xhr,textStatus,err) {
                 RED.nodes.dirty(true);
                 if (xhr.responseText) {
-                    RED.notify(RED._("notification.error",{message:xhr.responseJSON.message}),"error");
+                    RED.notify(RED._("notification.error",{message:xhr.responseText}),"error");
                 } else {
                     RED.notify(RED._("notification.error",{message:RED._("deploy.errors.noResponse")}),"error");
                 }
diff --git a/editor/js/ui/editor.js b/editor/js/ui/editor.js
index 1125b4d5d..4e078798f 100644
--- a/editor/js/ui/editor.js
+++ b/editor/js/ui/editor.js
@@ -287,6 +287,8 @@ RED.editor = (function() {
                                     }).done(function() {
                                             RED.library.loadFlowLibrary();
                                             RED.notify(RED._("library.savedNodes"),"success");
+                                    }).fail(function(xhr,textStatus,err) {
+                                        RED.notify(RED._("library.saveFailed",{message:xhr.responseText}),"error");
                                     });
                                 }
                             }
diff --git a/editor/js/ui/library.js b/editor/js/ui/library.js
index 15b7bb7b6..4918554d0 100644
--- a/editor/js/ui/library.js
+++ b/editor/js/ui/library.js
@@ -329,7 +329,7 @@ RED.library = (function() {
             }).done(function(data,textStatus,xhr) {
                 RED.notify(RED._("library.savedType", {type:options.type}),"success");
             }).fail(function(xhr,textStatus,err) {
-                RED.notify(RED._("library.saveFailed",{message:xhr.responseJSON.message}),"error");
+                RED.notify(RED._("library.saveFailed",{message:xhr.responseText}),"error");
             });
         }
         $( "#node-dialog-library-save-confirm" ).dialog({
diff --git a/editor/js/user.js b/editor/js/user.js
index 39049b443..d2968a550 100644
--- a/editor/js/user.js
+++ b/editor/js/user.js
@@ -86,7 +86,7 @@ RED.user = (function() {
                         var body = {
                             client_id: "node-red-editor",
                             grant_type: "password",
-                            scope:"*"
+                            scope:""
                         }
                         for (var i=0;i<data.prompts.length;i++) {
                             var field = data.prompts[i];
diff --git a/red/api/auth/permissions.js b/red/api/auth/permissions.js
index 132269a5a..4e1862cd9 100644
--- a/red/api/auth/permissions.js
+++ b/red/api/auth/permissions.js
@@ -32,11 +32,15 @@ function hasPermission(userScope,permission) {
         }
         return true;
     }
-    
-    if (userScope == "*") {
+
+    if (permission === "") {
         return true;
     }
-    
+
+    if (userScope === "*") {
+        return true;
+    }
+
     if (util.isArray(permission)) {
         for (i=0;i<permission.length;i++) {
             if (!hasPermission(userScope,permission[i])) {
@@ -45,8 +49,8 @@ function hasPermission(userScope,permission) {
         }
         return true;
     }
-    
-    if (userScope == "read") {
+
+    if (userScope === "read") {
         return readRE.test(permission);
     } else {
         return false; // anything not allowed is disallowed
diff --git a/red/api/auth/strategies.js b/red/api/auth/strategies.js
index 99d4e000b..6a61b77e0 100644
--- a/red/api/auth/strategies.js
+++ b/red/api/auth/strategies.js
@@ -85,6 +85,9 @@ var passwordTokenExchange = function(client, username, password, scope, done) {
 
     Users.authenticate(username,password).then(function(user) {
         if (user) {
+            if (scope === "") {
+                scope = user.permissions;
+            }
             if (permissions.hasPermission(user.permissions,scope)) {
                 loginAttempts = loginAttempts.filter(function(logEntry) {
                     return logEntry.user !== username;
diff --git a/test/red/api/auth/permissions_spec.js b/test/red/api/auth/permissions_spec.js
index 72d5119b1..b44ba5601 100644
--- a/test/red/api/auth/permissions_spec.js
+++ b/test/red/api/auth/permissions_spec.js
@@ -40,5 +40,9 @@ describe("Auth permissions", function() {
             permissions.hasPermission("read",["foo.read","foo.write"]).should.be.false;
             permissions.hasPermission("read",["foo.read","bar.read"]).should.be.true;
         });
+        it('permits an empty permission', function() {
+            permissions.hasPermission("*","").should.be.true;
+            permissions.hasPermission("read",[""]).should.be.true;
+        });
     });
 });