create permission controller

change url accept staff to sest permission