Probably worth splitting this in to two or three internal describe blocks - when logged in with permission, when logged in without permission, when not logged in.