Fresh installation (java) of Metabase, can't set permissions

Did a fresh installation of v0.20.3 with java on ubuntu 16.04, set custom environmental variables to connect to postgres database, works fine except trying to set permissions won’t save. Any ideas? here is the error in the log:

11-30 17:53:29 DEBUG metabase.middleware :: GET /api/permissions/graph 200 (346 ms) (4 DB calls) 11-30 17:53:36 ERROR metabase.middleware :: PUT /api/permissions/graph 500 (815 µs) (0 DB calls) {:type :schema.core/error, :schema [{:schema {:revision Int, :groups {Int {Int (constrained {(optional-key :native) (enum :read :write :none), (optional-key :schemas) (cond-pre (enum :all :none) {(maybe Str) (cond-pre (enum :all :none) {Int (enum :all :none)})})} "DB permissions with a valid combination of values for :native and :schemas")}}}, :optional? false, :name new-graph}], :value [{:revision 1, :groups {1 {2 {:native nil, :schemas :all}}, 2 {}, 3 {}}}], :error [(named {:groups {1 {2 {:native (not (#{:read :write :none} nil))}}}} new-graph)], :message "Input to update-graph! does not match schema: [(named {:groups {1 {2 {:native (not (#{:read :write :none} nil))}}}} new-graph)]", :stacktrace ["models.permissions$fn__16032$update_graph_BANG___16041.invoke(permissions.clj:437)" "api.permissions$fn__30067$fn__30069.invoke(permissions.clj:71)" "api.common.internal$wrap_catch_api_exceptions.invokeStatic(internal.clj:222)" "api.common.internal$wrap_catch_api_exceptions.invoke(internal.clj:219)" "api.permissions$fn__30067.invokeStatic(permissions.clj:59)" "api.permissions$fn__30067.invoke(permissions.clj:59)" "middleware$enforce_authentication$fn__30829.invoke(middleware.clj:84)" "api.routes$fn__30953.invokeStatic(routes.clj:54)" "api.routes$fn__30953.invoke(routes.clj:54)" "routes$fn__31914.invokeStatic(routes.clj:24)" "routes$fn__31914.invoke(routes.clj:24)" "middleware$log_api_call$fn__30917$fn__30919.invoke(middleware.clj:275)" "db$_do_with_call_counting.invokeStatic(db.clj:458)" "db$_do_with_call_counting.invoke(db.clj:452)" "middleware$log_api_call$fn__30917.invoke(middleware.clj:274)" "middleware$add_security_headers$fn__30876.invoke(middleware.clj:209)" "middleware$bind_current_user$fn__30833.invoke(middleware.clj:104)"]}