This commit makes the tests for the `broadcast` service permission more
robust by:
- adding coverage of endpoints that have been created since the test was
first written
- checking that the endpoint also responds to a `post` request with a
`403` (or `405` where it is a `get`-only endpoint)