add methods to User controller to update permissions