use self.client instead of creating our own instance
Add page permission tests (and fix the ever-so-subtle bug in preventing moves into a descendant page)