tests on roles and permissions