diff --git a/src/.coveragerc b/src/.coveragerc
index 9b820313c3..9b8509ef8b 100644
--- a/src/.coveragerc
+++ b/src/.coveragerc
@@ -1,6 +1,6 @@
 [run]
 source = tixlbase,tixlcontrol,tixlpresale
-omit = */migrations/*,*/urls.py
+omit = */migrations/*,*/urls.py,*/tests/*
 
 [report]
 exclude_lines =
diff --git a/src/tixlcontrol/tests.py b/src/tixlcontrol/tests.py
deleted file mode 100644
index 7ce503c2dd..0000000000
--- a/src/tixlcontrol/tests.py
+++ /dev/null
@@ -1,3 +0,0 @@
-from django.test import TestCase
-
-# Create your tests here.
diff --git a/src/tixlcontrol/tests/__init__.py b/src/tixlcontrol/tests/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/src/tixlcontrol/tests/test_auth.py b/src/tixlcontrol/tests/test_auth.py
new file mode 100644
index 0000000000..677eb9a5e1
--- /dev/null
+++ b/src/tixlcontrol/tests/test_auth.py
@@ -0,0 +1,79 @@
+from django.test import TestCase, Client
+
+from tixlbase.models import User
+
+
+class LoginFormTest(TestCase):
+    """
+    This test case tests various methods around the properties /
+    variations concept.
+    """
+
+    def setUp(self):
+        self.user = User.objects.create_user('dummy@dummy.dummy', 'dummy@dummy.dummy', 'dummy')
+
+    def test_wrong_credentials(self):
+        c = Client()
+        response = c.post('/control/login', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'foo',
+        })
+        self.assertEqual(response.status_code, 200)
+
+    def test_correct_credentials(self):
+        c = Client()
+        response = c.post('/control/login', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'dummy',
+        })
+        self.assertEqual(response.status_code, 302)
+
+    def test_inactive_account(self):
+        self.user.is_active = False
+        self.user.save()
+
+        c = Client()
+        response = c.post('/control/login', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'dummy',
+        })
+        self.assertEqual(response.status_code, 200)
+
+    def test_redirect(self):
+        c = Client()
+        response = c.post('/control/login?next=/control/events/', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'dummy',
+        })
+        self.assertEqual(response.status_code, 302)
+        self.assertIn('/control/events/', response['Location'])
+
+    def test_logged_in(self):
+        c = Client()
+        response = c.post('/control/login?next=/control/events/', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'dummy',
+        })
+        self.assertEqual(response.status_code, 302)
+        self.assertIn('/control/events/', response['Location'])
+
+        response = c.get('/control/login')
+        self.assertEqual(response.status_code, 302)
+
+        response = c.get('/control/login?next=/control/events/')
+        self.assertEqual(response.status_code, 302)
+        self.assertIn('/control/events/', response['Location'])
+
+    def test_logout(self):
+        c = Client()
+        response = c.post('/control/login', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'dummy',
+        })
+        self.assertEqual(response.status_code, 302)
+
+        response = c.get('/control/logout')
+        self.assertEqual(response.status_code, 302)
+
+        response = c.get('/control/login')
+        self.assertEqual(response.status_code, 200)
diff --git a/src/tixlcontrol/tests/test_permissions.py b/src/tixlcontrol/tests/test_permissions.py
new file mode 100644
index 0000000000..21bb9d057a
--- /dev/null
+++ b/src/tixlcontrol/tests/test_permissions.py
@@ -0,0 +1,69 @@
+from django.test import TestCase, Client
+from django.utils.timezone import now
+
+from tixlbase.models import Event, Organizer, User, EventPermission
+
+
+class PermissionMiddlewareTest(TestCase):
+    """
+    This test case tests various methods around the properties /
+    variations concept.
+    """
+
+    def setUp(self):
+        o = Organizer.objects.create(name='Dummy', slug='dummy')
+        self.event = Event.objects.create(
+            organizer=o, name='Dummy', slug='dummy',
+            date_from=now(),
+        )
+        self.user = User.objects.create_user('dummy@dummy.dummy', 'dummy@dummy.dummy', 'dummy')
+
+    def test_logged_out(self):
+        c = Client()
+        response = c.get('/control/login')
+        self.assertEqual(response.status_code, 200)
+        response = c.get('/control/events/')
+        self.assertEqual(response.status_code, 302)
+
+    def test_wrong_event(self):
+        c = Client()
+        response = c.post('/control/login', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'dummy',
+        })
+        self.assertEqual(response.status_code, 302)
+
+        response = c.get('/control/event/dummy/dummy/settings')
+        self.assertIn(response.status_code, (403, 404))
+
+    def test_wrong_event_permission(self):
+        EventPermission.objects.create(
+            event=self.event, user=self.user,
+            can_change_settings=False,
+            can_change_items=True,
+        )
+        c = Client()
+        response = c.post('/control/login', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'dummy',
+        })
+        self.assertEqual(response.status_code, 302)
+
+        response = c.get('/control/event/dummy/dummy/settings')
+        self.assertIn(response.status_code, (403, 404))
+
+    def test_correct(self):
+        EventPermission.objects.create(
+            event=self.event, user=self.user,
+            can_change_settings=True,
+            can_change_items=True,
+        )
+        c = Client()
+        response = c.post('/control/login', {
+            'email': 'dummy@dummy.dummy',
+            'password': 'dummy',
+        })
+        self.assertEqual(response.status_code, 302)
+
+        response = c.get('/control/event/dummy/dummy/settings')
+        self.assertEqual(response.status_code, 200)