Use application/hal+json to update permissions