yep! `def test_review_without_permission(self)` for example. We have tests for logged out and user without permission in every case AFAICT.