added unittests for permission check of exposing actions via OPTIONS