permissions statically defined in config.py, used in user update form