update permissions now take an updated fields argument, other fixes