more tests for authorization policies