update config.xml for permissions