express: set proper device permissions