Add route permissions guard tests