change permissions create to firstOrCreate to avoid dupes