Should there also be tests to verify that user a can't edit user b, but admin a can edit user b?