add permissions to bpm.contrib.hub
Merge remote-tracking branch 'origin/testing' into testing