fix all staff default perms