Legitimising platform discretion