Change permission endpoint to PUT instead of POST

PUT represents an object being updated, which is what is actually
happening here.