Fix: Set logged in user threadlocal in some tests

+ Security checks in tested methods require the threadlocal to be
  present