adding user permissions