tests for authorizing items

updated tests for each item creation/list, because now they start as unauthorized
implementing initial authorization system

still not verifying if the user has editor rights