Added protections for heroku user
Finished testing forbidden actions for heroku users