test user only permission