You might want to include an unauthorized test for user with NONE permission.