add another spec to check user rights