Excellent tests! Some things missing:

- Unit tests on permission and authentication classes
- Integration tests that test those permissions (ensure 4xx responses, etc)
- Testing `NonAMOAddonViewSet.post_save`