Add tests for @PreAuthorize