added some authorization tests for the controllers