update permission in user module
add daily limit