tests that user can't do things they're not allowed to do.