add the permission with shiro