test(controller): add unit tests for app-related permission checks
fix(controller): honor app permissions correctly on app-related views