Permissions not working as expected through REST API

Hi,

I am trying to use REST API to create users in Moodle.

I am getting token for a user which has "Student" role from below URL and able to get that token

http://yourdomain.com/moodle/login/token.php/?username=teststudent&password=blahblahblah&service=TEST_SERVICE

and now I am trying to create user through this token 

http://54.191.197.43/moodle/webservice/rest/server.php/?token=mytoken&wsfunction=moodle_user_create_user

but it still allows me to create user even if I set "Prohibit" for create user permission for "Student" role.

Can someone help me with this ?

Why permission check is not happening in this scenario ?