correct add_user and set user permissions