Fix: refresh user's permission tree if security model is refreshed