test/security: check capability get