correct permissions in controller
permissions update