Refine permissions tests

[bemson]

Several aspects of permissions need review...

For instance, I missed testing whether the sub group was being properly denied by state permissions (via .perms() or _perms). Will review tests to ensure all access groups are allowed and denied, both via declaratively and procedurally.