Fix where access was never granted because id was cast as string.  New tests focused on restricted access for user roles