Tests for mass update/admin auth/forbidden