adding permission checks to user requests, implementing tests for user routes