Add permissions to user profile route