Use fields_for to handle the permissions form. Fixes #742