UK: for tests user profile require_auth = False
UK: if /submission endpoint is accessed, check permissions since the user has to be authenticated at this endpoint