make permissions.rb actually idempotent
add Procfile