diff --git a/apps/core/config_views.py b/apps/core/config_views.py
index c391618..689e09e 100644
--- a/apps/core/config_views.py
+++ b/apps/core/config_views.py
@@ -256,6 +256,7 @@ def reset_user_password(request, user_id):
 
 
 from django.views.decorators.csrf import csrf_exempt
+from django.views.decorators.http import require_http_methods
 from rich import print
 from django.contrib.auth.hashers import check_password as verify_password
 
@@ -292,6 +293,7 @@ def toggle_user_active(request, user_id):
 
 
 @csrf_exempt
+@require_http_methods(["POST"])
 def test(request):
     import json
     from django.http import JsonResponse
diff --git a/apps/organizations/views.py b/apps/organizations/views.py
index 04e9db6..7e03644 100644
--- a/apps/organizations/views.py
+++ b/apps/organizations/views.py
@@ -761,7 +761,7 @@ def api_subsection_list(request):
     - location: Filter by location ID
     - main_section: Filter by main section ID
     """
-    subsections = LegacySubSection.objects.all().order_by("name")
+    subsections = LegacySubSection.objects.all().order_by("name_en")
 
     location_id = request.GET.get("location")
     main_section_id = request.GET.get("main_section")
diff --git a/apps/rca/views.py b/apps/rca/views.py
index 449bcb4..73e5c34 100644
--- a/apps/rca/views.py
+++ b/apps/rca/views.py
@@ -289,6 +289,8 @@ class RCACreateView(LoginRequiredMixin, CreateView):
     success_url = reverse_lazy("rca:rca_list")
 
     def dispatch(self, request, *args, **kwargs):
+        if not request.user.is_authenticated:
+            return self.handle_no_permission()
         _check_rca_create(request)
         return super().dispatch(request, *args, **kwargs)