update heroku settings, add permission control to REST interface