updateStaff now properly updates permissions