Permissions for a file linked to a node - chicken and egg

We use the REST interface to upload private files, and then link them to a new node, for which we grant specific user permissions - until Drupal 7.28 it all worked fine. As of 7.31 though our node creation fails for all newly created files, but works for older ones. After much debugging we discovered that the user creating the node (even if admin!) must have permission to access the file before being allowed to create a new node which points to it. That seems reasonable, BUT it seems that the only way to gain such permission is to have permission to access a node which already points to that file.....but that can't be created if you don't already have a node....and so on!

code in file_managed_code_value is this:

      if (isset($input['fid']) && ($file = file_load($input['fid']))) {      
        if (file_uri_scheme($file->uri) == 'public' || file_download_access($file->uri) ) {
          $fid = $file->fid;
        }
        // If the current user doesn't have access, don't let the file be
        // changed.
        else {
          $force_default = TRUE;
        }

I can work around this by removing the check in the code in file.module, but I'm loath to do so as it will need editing in any upgrades (not to mention the security hole)......so is there a proper means via the services to create the file and node together to avoid this chicken and egg situation? Or is there a better way altogether?