added controller tests for accessing resources that are not owned