Secure app with user permissions; add specs to confirm permissions are configured correctly

good that you figured this out. It took me a while to get it right back when learning about it