add permissions to controllers and test users