`AllowAppOwner` allows any authenticated user to access the listing (and seemingly create). If I use that instead `test_create` and `test_list` fail.