Allow TeamMember to view a workspace (now that we've removed Reader)
Add some permissions tests