update permissions controller update action