Add a cucumber test for access control