[core] fix failing specs on store
[api] add spec for denying updating a store as an user