fix update action of permissions controller