Add more tests on WAC services

Currently the tests on WAC services are very light-weight. Most actions are not tested. Since we are going to refactor a lot of them, and since WAC permissions are very important for security, we need to have a stronger coverage.

Start by locating the WAC services and their existing tests, then list the actions that currently lack coverage. Review how permissions are checked for each action and run the existing WAC test suite before changing anything. Done means the important service actions and permission cases have explicit tests, with the full suite passing.

Written by the indexing model from the issue text.