Services access permissions for user

Services module endpoint restful post returns code 403 access denied for user

User with admin permissions works with services module post, but authenticated user doesn't. The services module permissions are set for authenticated user same as admin. The post is initiated from Restclient with token. Authentication set to session authentication.

POST headers: X-CSF-Token:Xo-9aFac4_JZ1DSKi9rX6LqHcaK-PSJV3wChxllMOe Accept:application/json Content-type: application/json

Any idea why the post works for admin but not for authenticated user?

log shows this warning every time the post is sent:
Warning: Illegal offset type in isset or empty in user_access() (line 830 of /var/www/drupal-7.39/modules/user/user.module).

log messages with services debug turned on:

Passed arguments:
Array
(
    [0] => Array
    (
    [name] => Testing
    )

)

Controller:
Array
(
    [help] => Say "hello world2"
    [callback] => _tax_xy_post
    [access callback] => _xy_access
    [args] => Array
        (
            [0] => Array
                (
                    [name] => name
                    [type] => string
                    [description] => The person to greet
                    [source] => data
                    [optional] => 1
                )

        )

    [endpoint] => Array
        (
        )

)

Added the following code to xy.module file but didn't fix it. Note, xy is the custom module name.

function xy_permission() {
    return array(
        'xy post'=> array('title' => t('xy post'),'description' => t('post'),)
        );
}

function _xy_access($op, $args) {
  global $user;
  $access = FALSE;

  switch ($op) {
    case 'view':
      $note = xy_get_note($args[0]);
      $access = user_access('xy post');
      $access = $access || $note->uid == $user->uid && user_access('xy post');
      break;
  }

  return $access;
}


Here the resources code:
function xy_services_resources() {
  dd($_GET, $label = NULL);
  return array(
    'xyapi' => array(
      'operations' => array(
        'retrieve' => array(
            'help' => 'Say "hello world"',
            'callback' => '_xy_tp',
            'access callback' => 'user_access',
            'args' => array(
                array(
                    'name' => 'name',
                    'type' => 'string',
                    'description' => 'The person to greet',
                    'source' => array('path' => '0'),
                    'optional' => TRUE,
                ),
            ),
        ),
      ),  
     'actions' => array(
        'post' => array(
            'help' => 'Say "hello world2"',
            'callback' => '_xy_post',
            'access callback' => 'user_access',
            'args' => array(
                array(
                    'name' => 'name',
                    'type' => 'string',
                    'description' => 'The person to greet',
                    'source' => 'data',
                    'optional' => TRUE,
                ),
            ),
        ),
      ),
     ),
  );
}