test cleanup, small tweak to isAuthorized permissions on add()