Secure app with user permissions; add specs to confirm permissions are configured correctly

same here. and when you move it to the top of the action, you can get rid of the 'and returns'