fixed permission bug where user's user group was not added to parent roles and permission was denied