added permission tests, implemented permission controller actions