more tests for permissions, for payment_methods