tidy up permissions