improved permissions model
improved permission and role controller