syncronize permissions with rails routes