Add some missing permission tests, fix OPTIONS