add tests for all the different auth/access paths

there's now a bunch configured; it would be good to have a test that all the actions work

i'm actually not sure how to go about this; given that it should be done via the JWTs.