open up client key permissions on `users`