update factory for user to include permission