grant and revoke are now behaving accordingly, but tests are failing now. did some further cleanup