add permissions in config.xml