fix user permissions