Add test for unauthorized access