Add testing for authorisation

[gsarmaonline]

Different test cases:

• Test for basic object access for different types of users
• Test for the hierarchical flow where we have wildcarded objects
• Test for flows where there are no exact matching rules