Secure app with user permissions; add specs to confirm permissions are configured correctly

tiny indentation problem still, almost there