add some permission tests