UserPermissions routes & accompanying tests