tests to make sure non-admins have no rights