Secure app with user permissions; add specs to confirm permissions are configured correctly

shouldn't the expectation be that this user can destroy the app? So same expectation as admin