add more permission tests