added permissions for users