added authorization tests for different types of users