add user and permission