user permissions tests