added access control tests