Secure app with user permissions; add specs to confirm permissions are configured correctly

same here - missing scenario for user who owns the app