put vendor assets in vendor; fix permissions