Shouldn't there be a test for a user that is granted cloud_controller.write since that was exposed as a possiblity via  buildpack_access.rb?