update route and permission controller