Arango update from 3.3 to 3.7

I've been running on Arango 3.3. I booted a new server with Arango 3.7. I've configured both Arangos identically (as much as I can) -- same DBs, data, users, passwords and permissions. But the server code that accesses version 3.3 fails when I point it at 3.7. Connection succeeds on both, returning a jwt. Using that jwt in subsequent queries succeeds on 3.3, but fails on 3.7 with "not authorized to execute this request". I've checked and rechecked user permissions, and as far as I can tell they are the same. Has something changed between 3.3 and 3.7 that I'm missing?