"Invalid OAuth access token" when using valid token

When trying to use the Deezer JS SDK to access /user/me, I keep getting error code 300 (Invalid OAuth access token). My code is mostly copied from the examples so I can't figure out why this would be happening. I've tried manually specifying the token in the API call, and directly accessing the API via HTTP and haven't gotten past the Invalid Access Token error. What am I doing wrong?

index.html:

<!doctype html>
<html>
    <body>
        <div id="dz-root"></div>
        <a href="#" id="dtest">Login</a>
        <a href="#" id="lstat">Get Login Status</a>
        <a href="#" id="getme">Me</a>
        <script type="text/javascript" src="http://cdn-files.deezer.com/js/min/dz.js"></script>
        <script src="js/index.js"></script>
    </body>
</html>

index.js:

DZ.init({
    appId: "253122",
    channelUrl: "http://mopho.local/deezer-channel.html",
});

document.getElementById("dtest").addEventListener("click", () => {
    DZ.login(function(response) {
        console.log("1",response);
    }, {perms: 'basic_access,email'});
});

document.getElementById("lstat").addEventListener("click", () => {
    DZ.getLoginStatus(function(response) {
        console.log(response);
    });
});

document.getElementById("getme").addEventListener("click", () => {
    DZ.api('/user/me',
         function(response) {
            console.log("2",response);
        }
    );
});

deezer-channel.html:

<script src="http://cdn-files.deezer.com/js/min/dz.js"></script>

mopho.local is configured in my hosts file + nginx to point to 127.0.0.1.

My Deezer app has the following configuration:

Application domain: mopho.local
Redirect URL after authentication: http://mopho.local

Solution

This turned out to be a permissions issue. I changed the permissions to "basic_access,email,offline_access,manage_library,manage_community,delete_library,listening_history" and it worked. I'm not sure which of the returned data points were associated with which permissions, but my guess is that some of the permissions were changed on the back end and the examples in the docs haven't caught up.