added more specs to check permissions in apps and in users