update permissions controller