added tests for user with no role cannot access anything