Secure app with user permissions; add specs to confirm permissions are configured correctly

maybe add a scenario for when a regular user owns the app? And rename 'as regular user' above to 'as regular user who doesn't own the app'