Cleaned up statement in permissions update endpoint in api.php