added upload / download in user permissions