Add permissions to the login api