Re-added permissions to the user endpoint