add some unit tests to access control framework