update app permissions