add permission in cookie