Try to add this code:
public override void Initialize()
{
var config = Abp.Dependency.IocManager.Instance.Resolve<IAbpWebApiModuleConfiguration>().HttpConfiguration;
config.MapHttpAttributeRoutes();
}
Permissions are loaded once at start from script as object(abp.auth.grantedPermissions). To refresh permissions reload this script with them (and some other additional data) with the help of, for example jQuery's method:
$.getScript("AbpScripts/GetScripts")