added permissions controller