update user permission