fix bugged permissions system
move permissions config to main route config