Add test for making sure cancel subscription API will not be accessed without permission