give permissions 1st. also bug in get_roles_by_permission