added test cases for user & object authorization