extra tests, better functionality

Also took out come of the permissions-changing in the web test case, half because recent changes had stopped them from working correctly, and half because we now have a test specifically to look at permissions.