add permissions to users