save user permissions