add tests for user can't do some actions