updates for user permissions