correcting the documented permission required for sync and publish

I confirmed this by looking at the web controllers directly.