Recommend adding a permission test for the new action.  Might be useful to also have a negative test (e.g. when path not provided).