Check more authorized uses at controllers

With these tests we ensure that the right users are able to access
various controllers properly and that people cannot skirt around our
security checks in a straightforward manner.