Two suggestions on that.
Try removing
'access arguments append' => TRUE
and clear cache. It can interfere with theuser_access
check.Depending on your authentication method, you may need to set the correct
X-CSRF-Token
authentication token in the request. See Problems with Services and CSRF tokenProblems with Services and CSRF token