fix missing User#direct_debit permission