updated permissions in config.xml