More tests for /api/pendingacls in json restricted with a username that has no pending ACLs