permission module passes tests
update comments