diff --git a/src/controllers/admin/blacklist.js b/src/controllers/admin/blacklist.js
index 7ce4edda49..fb92f377b5 100644
--- a/src/controllers/admin/blacklist.js
+++ b/src/controllers/admin/blacklist.js
@@ -1,19 +1,20 @@
 'use strict';
 
+var async = require('async');
 var meta = require('../../meta');
 
-var blacklistController = {};
+var blacklistController = module.exports;
 
 blacklistController.get = function (req, res, next) {
-	meta.blacklist.get(function (err, rules) {
-		if (err) {
-			return next(err);
-		}
-		res.render('admin/manage/ip-blacklist', {
-			rules: rules,
-			title: '[[pages:ip-blacklist]]',
-		});
-	});
+	async.waterfall([
+		function (next) {
+			meta.blacklist.get(next);
+		},
+		function (rules) {
+			res.render('admin/manage/ip-blacklist', {
+				rules: rules,
+				title: '[[pages:ip-blacklist]]',
+			});
+		},
+	], next);
 };
-
-module.exports = blacklistController;
diff --git a/src/controllers/globalmods.js b/src/controllers/globalmods.js
index 793c33653e..1cae97a4e2 100644
--- a/src/controllers/globalmods.js
+++ b/src/controllers/globalmods.js
@@ -1,18 +1,22 @@
 'use strict';
 
+var async = require('async');
+
 var user = require('../user');
 var adminBlacklistController = require('./admin/blacklist');
 
-var globalModsController = {};
+var globalModsController = module.exports;
 
 globalModsController.ipBlacklist = function (req, res, next) {
-	user.isAdminOrGlobalMod(req.uid, function (err, isAdminOrGlobalMod) {
-		if (err || !isAdminOrGlobalMod) {
-			return next(err);
-		}
-
-		adminBlacklistController.get(req, res, next);
-	});
+	async.waterfall([
+		function (next) {
+			user.isAdminOrGlobalMod(req.uid, next);
+		},
+		function (isAdminOrGlobalMod, next) {
+			if (!isAdminOrGlobalMod) {
+				return next();
+			}
+			adminBlacklistController.get(req, res, next);
+		},
+	], next);
 };
-
-module.exports = globalModsController;
diff --git a/test/controllers-admin.js b/test/controllers-admin.js
index 086d54e7a8..83d3b94fad 100644
--- a/test/controllers-admin.js
+++ b/test/controllers-admin.js
@@ -414,6 +414,23 @@ describe('Admin Controllers', function () {
 		});
 	});
 
+	it('/ip-blacklist should 404 for regular user', function (done) {
+		request(nconf.get('url') + '/api/ip-blacklist', { json: true }, function (err, res, body) {
+			assert.ifError(err);
+			assert(body);
+			assert.equal(res.statusCode, 404);
+			done();
+		});
+	});
+
+	it('should load /ip-blacklist', function (done) {
+		request(nconf.get('url') + '/api/ip-blacklist', { jar: jar, json: true }, function (err, res, body) {
+			assert.ifError(err);
+			assert(body);
+			done();
+		});
+	});
+
 	it('should load /admin/appearance/themes', function (done) {
 		request(nconf.get('url') + '/api/admin/appearance/themes', { jar: jar, json: true }, function (err, res, body) {
 			assert.ifError(err);
diff --git a/test/uploads.js b/test/uploads.js
index 57b7a67ed0..5acc480e4c 100644
--- a/test/uploads.js
+++ b/test/uploads.js
@@ -218,6 +218,24 @@ describe('Upload Controllers', function () {
 			});
 		});
 
+		it('should upload default avatar', function (done) {
+			helpers.uploadFile(nconf.get('url') + '/api/admin/uploadDefaultAvatar', path.join(__dirname, '../test/files/test.png'), { }, jar, csrf_token, function (err, res, body) {
+				assert.ifError(err);
+				assert.equal(res.statusCode, 200);
+				assert.equal(body[0].url, nconf.get('relative_path') + '/assets/uploads/system/avatar-default.png');
+				done();
+			});
+		});
+
+		it('should upload og image', function (done) {
+			helpers.uploadFile(nconf.get('url') + '/api/admin/uploadOgImage', path.join(__dirname, '../test/files/test.png'), { }, jar, csrf_token, function (err, res, body) {
+				assert.ifError(err);
+				assert.equal(res.statusCode, 200);
+				assert.equal(body[0].url, nconf.get('relative_path') + '/assets/uploads/system/og-image.png');
+				done();
+			});
+		});
+
 		it('should upload favicon', function (done) {
 			helpers.uploadFile(nconf.get('url') + '/api/admin/uploadfavicon', path.join(__dirname, '../test/files/favicon.ico'), {}, jar, csrf_token, function (err, res, body) {
 				assert.ifError(err);