update profile permissions