add permission tests for guest and admin