add some permission tests for create event