test admin scope and unauthorized