last controller test without rbac/acl