Aside from testing that UnauthorizedException is not not thrown, this also tests that relation user does not have access to is not loaded. @MLoureiro is right, that is not tested elsewhere.