 										updatedTrans.request.body.should.equal "<HTTP body update>"
 										updatedTrans.request.method.should.equal "PUT"
 										done()
+
+			it "should only allow admin user to update a transaction", (done) ->
+				tx = new Transaction transactionData
+				tx.save (err, result) ->
+					should.not.exist(err)
+					transactionId = result._id
+					updates = {}
+					server.start null, null, 8080,  ->
+						request("http://localhost:8080")
+							.put("/transactions/#{transactionId}")
+							.set("auth-username", nonRootUser.email)
+							.set("auth-ts", authDetails.authTS)
+							.set("auth-salt", authDetails.authSalt)
+							.set("auth-token", authDetails.authToken)
+							.send(updates)
+							.expect(401)
+							.end (err, res) ->													
+								if err
+									done err
+								else
+									done()
 
 		describe ".getTransactions", ->
 

									done()

		describe ".removeTransaction (transactionId)", ->
			it "should call removeTransaction", (done) ->
				transactionData.clientID = "transaction_to_remove"
				tx = new Transaction transactionData

										should.not.exist(err)
										(transDoc == null).should.be.true
										done()

			it "should only allow admin users to remove transactions", (done) ->
				transactionData.clientID = "transaction_to_remove"
				tx = new Transaction transactionData
				tx.save (err, result) ->
					should.not.exist(err)
					transactionId = result._id
					server.start null, null, 8080, ->
						request("http://localhost:8080")
							.del("/transactions/#{transactionId}")
							.set("auth-username", nonRootUser.email)
							.set("auth-ts", authDetails.authTS)
							.set("auth-salt", authDetails.authSalt)
							.set("auth-token", authDetails.authToken)
							.expect(401)
							.end (err, res) ->
								if err
									done err
								else
									done()
