fix backend permissions