change user permissions in users_controller