completed basic test suite, fixed api controller behaviour in checking methods and permissions