test user only permission3