add permission to all controllers
add permission to button