diff --git a/ordr2/resources/__init__.py b/ordr2/resources/__init__.py
index a56c87f..1d134d0 100644
--- a/ordr2/resources/__init__.py
+++ b/ordr2/resources/__init__.py
@@ -31,7 +31,7 @@ class RootResource(BaseResource):
 
     def __acl__(self):
         ''' access controll list for the resource '''
-        return [(Allow, Everyone, 'view')]
+        return [(Allow, Everyone, 'view'), DENY_ALL]
 
 
 def includeme(config):
diff --git a/tests/resources/__init__.py b/tests/resources/__init__.py
index 1d5e0e8..1883e00 100644
--- a/tests/resources/__init__.py
+++ b/tests/resources/__init__.py
@@ -1,49 +1,7 @@
 ''' Test package for ordr2.resources '''
 
-import pytest
-
-
-def test_base_resource_init():
-    ''' test __init__ function of base resource '''
-    from ordr2.resources import BaseResource, RootResource
-
-    root = RootResource('request object')
-    resource = BaseResource('resource name', root, 'model instance')
-
-    assert resource.__name__ == 'resource name'
-    assert resource.__parent__ == root
-    assert resource.request == 'request object'
-    assert resource.model == 'model instance'
-
-
-def test_base_resource_acl():
-    ''' test __acl__ function of base resource '''
-    from ordr2.resources import BaseResource, RootResource
-    from pyramid.security import DENY_ALL
 
-    root = RootResource('request object')
-    resource = BaseResource('resource name', root, 'model instance')
-
-    assert resource.__acl__() == [ DENY_ALL ]
-
-
-@pytest.mark.parametrize(
-    'segment', [
-        'known',
-        pytest.mark.xfail('unknown', raises=KeyError)
-        ]
-    )
-def test_base_resource_getitem(segment):
-    ''' test the __getitem__ function of base resource '''
-    from ordr2.resources import BaseResource, RootResource
-
-    root = RootResource('request object')
-    root.nodes = {'known': BaseResource}
-    resource = root[segment]
-
-    assert resource.__name__ == 'known'
-    assert resource.__parent__ == root
-    assert resource.request == 'request object'
+import pytest
 
 
 def test_root_resource_init():
@@ -60,8 +18,8 @@ def test_root_resource_init():
 def test_root_resource_acl():
     ''' test __acl__ function of root resource '''
     from ordr2.resources import RootResource
-    from pyramid.security import Allow, Everyone
+    from pyramid.security import Allow, Everyone, DENY_ALL
 
     root = RootResource('request object')
 
-    assert root.__acl__() == [ (Allow, Everyone, 'view') ]
+    assert root.__acl__() == [ (Allow, Everyone, 'view'), DENY_ALL ]
diff --git a/tests/resources/account.py b/tests/resources/account.py
new file mode 100644
index 0000000..b573b18
--- /dev/null
+++ b/tests/resources/account.py
@@ -0,0 +1,39 @@
+''' Tests for ordr2.resources.account '''
+
+import pytest
+
+
+def test_account_resource_init():
+    ''' test __init__ function of base resource '''
+    from pyramid.testing import DummyRequest
+    from ordr2.resources import AccountResource, RootResource
+
+    request = DummyRequest(user='Eric Idle')
+    root = RootResource(request)
+    resource = AccountResource('resource name', root)
+
+    assert resource.__name__ == 'resource name'
+    assert resource.__parent__ == root
+    assert resource.request == request
+    assert resource.model == request.user
+
+
+def test_account_resource_acl():
+    ''' test __acl__ function of base resource '''
+    from pyramid.security import Allow, Authenticated, Deny, Everyone, DENY_ALL
+    from pyramid.testing import DummyRequest
+    from ordr2.resources import AccountResource, RootResource
+
+    request = DummyRequest(user=None)
+    root = RootResource(request)
+    resource = AccountResource('resource name', root)
+
+    assert resource.__acl__() == [
+            (Allow, Everyone, 'login'),
+            (Allow, Everyone, 'logout'),
+            (Deny, Authenticated, 'register'),
+            (Allow, Everyone, 'register'),
+            (Allow, Authenticated, 'settings'),
+            DENY_ALL
+        ]
+
diff --git a/tests/resources/base.py b/tests/resources/base.py
new file mode 100644
index 0000000..35596d0
--- /dev/null
+++ b/tests/resources/base.py
@@ -0,0 +1,47 @@
+''' Tests for ordr2.resources.base '''
+
+import pytest
+
+
+def test_base_resource_init():
+    ''' test __init__ function of base resource '''
+    from ordr2.resources import BaseResource, RootResource
+
+    root = RootResource('request object')
+    resource = BaseResource('resource name', root, 'model instance')
+
+    assert resource.__name__ == 'resource name'
+    assert resource.__parent__ == root
+    assert resource.request == 'request object'
+    assert resource.model == 'model instance'
+
+
+def test_base_resource_acl():
+    ''' test __acl__ function of base resource '''
+    from ordr2.resources import BaseResource, RootResource
+    from pyramid.security import DENY_ALL
+
+    root = RootResource('request object')
+    resource = BaseResource('resource name', root, 'model instance')
+
+    with pytest.raises(NotImplementedError):
+        assert resource.__acl__()
+
+
+@pytest.mark.parametrize(
+    'segment', [
+        'known',
+        pytest.mark.xfail('unknown', raises=KeyError)
+        ]
+    )
+def test_base_resource_getitem(segment):
+    ''' test the __getitem__ function of base resource '''
+    from ordr2.resources import BaseResource, RootResource
+
+    root = RootResource('request object')
+    root.nodes = {'known': BaseResource}
+    resource = root[segment]
+
+    assert resource.__name__ == 'known'
+    assert resource.__parent__ == root
+    assert resource.request == 'request object'