Secure app with user permissions; add specs to confirm permissions are configured correctly

hmm, maybe a file encoding issue? I'd google around for this