Secure app with user permissions; add specs to confirm permissions are configured correctly

the authorization be better at the top of the action, to avoid needlessly executing the code in it in case it's not authorized