use least privileged member for controller testing