set perms only when they're wrong, to avoid spotlight freakout