Moved all permissions tests from layers to security