* changes: fix enrollment application permission check add KEYPHRASE_ENROLLMENT_APPLICATION permission