But that only applies to the proxied routes no? What about the actions in the controller itself? Those are not covered here in this proxy test because these only apply to proxied routes and for the non-proxied actions we don't want to allow consumer or user access. In some cases we only want the consumer to be able to perform the action on itself.