Secure app with user permissions; add specs to confirm permissions are configured correctly

this works, but it would be better if you accomplished it with factories instead of repeating the steps.