writing more tests for the access control and api