further tests for permission controller