@dmitchell Do we have ACL tests that check denials? All the tests in test_access.py are positive - just making sure the user has in an expected role.  Where are tests to make sure the user does NOT have a role that s/he shouldn't have?