move set_permission and describe_permissions to user_profile controller.