diff --git a/src/Umbraco.Tests.Common/TestHelpers/Entities/MockedUser.cs b/src/Umbraco.Tests.Common/TestHelpers/Entities/MockedUser.cs
new file mode 100644
index 0000000000..7488fc1a88
--- /dev/null
+++ b/src/Umbraco.Tests.Common/TestHelpers/Entities/MockedUser.cs
@@ -0,0 +1,25 @@
+using Moq;
+using System;
+using System.Collections.Generic;
+using Umbraco.Core.Models.Membership;
+
+namespace Umbraco.Tests.Common.TestHelpers.Entities
+{
+    public static class MockedUser
+    {
+        /// <summary>
+        /// Returns a <see cref="Mock{IUser}"/> and ensures that the ToUserCache and FromUserCache methods are mapped correctly for
+        /// dealing with start node caches
+        /// </summary>
+        /// <returns></returns>
+        public static Mock<IUser> GetUserMock()
+        {
+            var userCache = new Dictionary<string, object>();
+            var userMock = new Mock<IUser>();
+            userMock.Setup(x => x.FromUserCache<int[]>(It.IsAny<string>())).Returns((string key) => userCache.TryGetValue(key, out var val) ? val is int[] iVal ? iVal : null : null);
+            userMock.Setup(x => x.ToUserCache<int[]>(It.IsAny<string>(), It.IsAny<int[]>())).Callback((string key, int[] val) => userCache[key] = val);
+            return userMock;
+        }
+
+    }
+}
diff --git a/src/Umbraco.Tests/Web/Controllers/MediaControllerUnitTests.cs b/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Controllers/MediaControllerUnitTests.cs
similarity index 92%
rename from src/Umbraco.Tests/Web/Controllers/MediaControllerUnitTests.cs
rename to src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Controllers/MediaControllerUnitTests.cs
index 736e0c3dfa..aef08cec5a 100644
--- a/src/Umbraco.Tests/Web/Controllers/MediaControllerUnitTests.cs
+++ b/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Controllers/MediaControllerUnitTests.cs
@@ -1,13 +1,13 @@
 using System.Collections.Generic;
-using System.Web.Http;
 using Moq;
 using NUnit.Framework;
 using Umbraco.Core.Models;
 using Umbraco.Core.Models.Entities;
 using Umbraco.Core.Models.Membership;
 using Umbraco.Core.Services;
-using Umbraco.Tests.TestHelpers.Entities;
-using Umbraco.Web.Editors;
+using Umbraco.Tests.Common.TestHelpers.Entities;
+using Umbraco.Web.BackOffice.Controllers;
+using Umbraco.Web.Common.Exceptions;
 
 namespace Umbraco.Tests.Web.Controllers
 {
@@ -32,7 +32,7 @@ namespace Umbraco.Tests.Web.Controllers
             var entityService = entityServiceMock.Object;
 
             //act
-            var result = MediaController.CheckPermissions(new Dictionary<string, object>(), user, mediaService, entityService, 1234);
+            var result = MediaController.CheckPermissions(new Dictionary<object, object>(), user, mediaService, entityService, 1234);
 
             //assert
             Assert.IsTrue(result);
@@ -55,7 +55,7 @@ namespace Umbraco.Tests.Web.Controllers
             var entityService = entityServiceMock.Object;
 
             //act/assert
-            Assert.Throws<HttpResponseException>(() => MediaController.CheckPermissions(new Dictionary<string, object>(), user, mediaService, entityService, 1234));
+            Assert.Throws<HttpResponseException>(() => MediaController.CheckPermissions(new Dictionary<object, object>(), user, mediaService, entityService, 1234));
         }
 
         [Test]
@@ -78,7 +78,7 @@ namespace Umbraco.Tests.Web.Controllers
             var entityService = entityServiceMock.Object;
 
             //act
-            var result = MediaController.CheckPermissions(new Dictionary<string, object>(), user, mediaService, entityService, 1234);
+            var result = MediaController.CheckPermissions(new Dictionary<object, object>(), user, mediaService, entityService, 1234);
 
             //assert
             Assert.IsFalse(result);
@@ -98,7 +98,7 @@ namespace Umbraco.Tests.Web.Controllers
             var entityService = entityServiceMock.Object;
 
             //act
-            var result = MediaController.CheckPermissions(new Dictionary<string, object>(), user, mediaService, entityService, -1);
+            var result = MediaController.CheckPermissions(new Dictionary<object, object>(), user, mediaService, entityService, -1);
 
             //assert
             Assert.IsTrue(result);
@@ -120,7 +120,7 @@ namespace Umbraco.Tests.Web.Controllers
             var entityService = entityServiceMock.Object;
 
             //act
-            var result = MediaController.CheckPermissions(new Dictionary<string, object>(), user, mediaService, entityService, -1);
+            var result = MediaController.CheckPermissions(new Dictionary<object, object>(), user, mediaService, entityService, -1);
 
             //assert
             Assert.IsFalse(result);
@@ -140,7 +140,7 @@ namespace Umbraco.Tests.Web.Controllers
             var entityService = entityServiceMock.Object;
 
             //act
-            var result = MediaController.CheckPermissions(new Dictionary<string, object>(), user, mediaService, entityService, -21);
+            var result = MediaController.CheckPermissions(new Dictionary<object, object>(), user, mediaService, entityService, -21);
 
             //assert
             Assert.IsTrue(result);
@@ -162,7 +162,7 @@ namespace Umbraco.Tests.Web.Controllers
             var entityService = entityServiceMock.Object;
 
             //act
-            var result = MediaController.CheckPermissions(new Dictionary<string, object>(), user, mediaService, entityService, -21);
+            var result = MediaController.CheckPermissions(new Dictionary<object, object>(), user, mediaService, entityService, -21);
 
             //assert
             Assert.IsFalse(result);
diff --git a/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Filters/FilterAllowedOutgoingContentAttributeTests.cs b/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Filters/FilterAllowedOutgoingContentAttributeTests.cs
new file mode 100644
index 0000000000..54499d97ba
--- /dev/null
+++ b/src/Umbraco.Tests.UnitTests/Umbraco.Web.BackOffice/Filters/FilterAllowedOutgoingContentAttributeTests.cs
@@ -0,0 +1,162 @@
+using System.Collections.Generic;
+using System.Linq;
+using System.Net.Http.Headers;
+using Microsoft.AspNetCore.Mvc;
+using Moq;
+using NUnit.Framework;
+using Umbraco.Core;
+using Umbraco.Core.Models;
+using Umbraco.Core.Models.Entities;
+using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Services;
+using Umbraco.Tests.Common.TestHelpers.Entities;
+using Umbraco.Web.Actions;
+using Umbraco.Web.BackOffice.Filters;
+using Umbraco.Web.Models.ContentEditing;
+using Umbraco.Web.Security;
+
+namespace Umbraco.Tests.Web.Controllers
+{
+    [TestFixture]
+    public class FilterAllowedOutgoingContentAttributeTests
+    {
+        [Test]
+        public void GetValueFromResponse_Already_EnumerableContent()
+        {
+            var expected = new List<ContentItemBasic>() {new ContentItemBasic()};
+
+            var att = new FilterAllowedOutgoingContentFilter(expected.GetType(),
+                null,
+                ActionBrowse.ActionLetter,
+                Mock.Of<IUserService>(),
+                Mock.Of<IEntityService>(),
+                Mock.Of<IWebSecurity>() );
+
+            var result = att.GetValueFromResponse(new ObjectResult(expected));
+
+            Assert.AreEqual(expected, result);
+        }
+
+        [Test]
+        public void GetValueFromResponse_From_Property()
+        {
+            var expected = new List<ContentItemBasic>() { new ContentItemBasic() };
+            var container = new MyTestClass() {MyList = expected};
+
+            var att = new FilterAllowedOutgoingContentFilter(expected.GetType(),
+                nameof(MyTestClass.MyList),
+                ActionBrowse.ActionLetter,
+                Mock.Of<IUserService>(),
+                Mock.Of<IEntityService>(),
+                Mock.Of<IWebSecurity>() );
+
+            var result = att.GetValueFromResponse(new ObjectResult(container));
+
+            Assert.AreEqual(expected, result);
+        }
+
+        [Test]
+        public void GetValueFromResponse_Returns_Null_Not_Found_Property()
+        {
+            var expected = new List<ContentItemBasic>() { new ContentItemBasic() };
+            var container = new MyTestClass() { MyList = expected };
+
+            var att = new FilterAllowedOutgoingContentFilter(expected.GetType(),
+                "DontFind",
+                ActionBrowse.ActionLetter,
+                Mock.Of<IUserService>(),
+                Mock.Of<IEntityService>(),
+                Mock.Of<IWebSecurity>() );
+
+            var actual = att.GetValueFromResponse(new ObjectResult(container));
+
+            Assert.IsNull(actual);
+
+        }
+
+        [Test]
+        public void Filter_On_Start_Node()
+        {
+            var userMock = MockedUser.GetUserMock();
+            userMock.Setup(u => u.Id).Returns(9);
+            userMock.Setup(u => u.StartContentIds).Returns(new[] { 5 });
+            var user = userMock.Object;
+            var userServiceMock = new Mock<IUserService>();
+            var userService = userServiceMock.Object;
+            var entityServiceMock = new Mock<IEntityService>();
+            entityServiceMock.Setup(x => x.GetAllPaths(It.IsAny<UmbracoObjectTypes>(), It.IsAny<int[]>()))
+                .Returns(new[] { Mock.Of<TreeEntityPath>(entity => entity.Id == 5 && entity.Path == "-1,5") });
+            var entityService = entityServiceMock.Object;
+
+            var list = new List<ContentItemBasic>();
+            var att = new FilterAllowedOutgoingContentFilter(list.GetType(),
+                null,
+                ActionBrowse.ActionLetter,
+                userService,
+                entityService,
+                Mock.Of<IWebSecurity>() );
+
+            var path = "";
+            for (var i = 0; i < 10; i++)
+            {
+                if (i > 0 && path.EndsWith(",") == false)
+                {
+                    path += ",";
+                }
+                path += i.ToInvariantString();
+                list.Add(new ContentItemBasic { Id = i, Name = "Test" + i, ParentId = i, Path = path });
+            }
+
+            att.FilterBasedOnStartNode(list, user);
+
+            Assert.AreEqual(5, list.Count);
+
+       }
+
+        [Test]
+        public void Filter_On_Permissions()
+        {
+            var list = new List<ContentItemBasic>();
+            for (var i = 0; i < 10; i++)
+            {
+                list.Add(new ContentItemBasic{Id = i, Name = "Test" + i, ParentId = -1});
+            }
+            var ids = list.Select(x => (int)x.Id).ToArray();
+
+            var userMock = MockedUser.GetUserMock();
+            userMock.Setup(u => u.Id).Returns(9);
+            userMock.Setup(u => u.StartContentIds).Returns(new int[0]);
+            var user = userMock.Object;
+
+            var userServiceMock = new Mock<IUserService>();
+            //we're only assigning 3 nodes browse permissions so that is what we expect as a result
+            var permissions = new EntityPermissionCollection
+            {
+                new EntityPermission(9876, 1, new string[]{ ActionBrowse.ActionLetter.ToString() }),
+                new EntityPermission(9876, 2, new string[]{ ActionBrowse.ActionLetter.ToString() }),
+                new EntityPermission(9876, 3, new string[]{ ActionBrowse.ActionLetter.ToString() }),
+                new EntityPermission(9876, 4, new string[]{ ActionUpdate.ActionLetter.ToString() })
+            };
+            userServiceMock.Setup(x => x.GetPermissions(user, ids)).Returns(permissions);
+            var userService = userServiceMock.Object;
+
+            var att = new FilterAllowedOutgoingContentFilter(list.GetType(),
+                null,
+                ActionBrowse.ActionLetter,
+                userService,
+                Mock.Of<IEntityService>(),
+                Mock.Of<IWebSecurity>() );
+            att.FilterBasedOnPermissions(list, user);
+
+            Assert.AreEqual(3, list.Count);
+            Assert.AreEqual(1, list.ElementAt(0).Id);
+            Assert.AreEqual(2, list.ElementAt(1).Id);
+            Assert.AreEqual(3, list.ElementAt(2).Id);
+        }
+
+        private class MyTestClass
+        {
+            public IEnumerable<ContentItemBasic> MyList { get; set; }
+        }
+    }
+}
diff --git a/src/Umbraco.Tests/Umbraco.Tests.csproj b/src/Umbraco.Tests/Umbraco.Tests.csproj
index 46fb33335f..4f0e5e1810 100644
--- a/src/Umbraco.Tests/Umbraco.Tests.csproj
+++ b/src/Umbraco.Tests/Umbraco.Tests.csproj
@@ -296,8 +296,6 @@
     <Compile Include="Cache\HttpRequestAppCacheTests.cs" />
     <Compile Include="Cache\RuntimeAppCacheTests.cs" />
     <Compile Include="Web\Controllers\ContentControllerUnitTests.cs" />
-    <Compile Include="Web\Controllers\FilterAllowedOutgoingContentAttributeTests.cs" />
-    <Compile Include="Web\Controllers\MediaControllerUnitTests.cs" />
     <Compile Include="CoreXml\FrameworkXmlTests.cs" />
     <Compile Include="Macros\MacroParserTests.cs" />
     <Compile Include="Models\ContentExtensionsTests.cs" />
diff --git a/src/Umbraco.Tests/Web/Controllers/FilterAllowedOutgoingContentAttributeTests.cs b/src/Umbraco.Tests/Web/Controllers/FilterAllowedOutgoingContentAttributeTests.cs
deleted file mode 100644
index c72bd6be20..0000000000
--- a/src/Umbraco.Tests/Web/Controllers/FilterAllowedOutgoingContentAttributeTests.cs
+++ /dev/null
@@ -1,162 +0,0 @@
-using System.Collections.Generic;
-using System.Linq;
-using System.Net.Http;
-using System.Net.Http.Formatting;
-using System.Net.Http.Headers;
-using Moq;
-using NUnit.Framework;
-using Umbraco.Core;
-using Umbraco.Core.Models;
-using Umbraco.Core.Models.Entities;
-using Umbraco.Core.Models.Membership;
-using Umbraco.Core.Services;
-using Umbraco.Tests.TestHelpers.Entities;
-using Umbraco.Web.Models.ContentEditing;
-using Umbraco.Web.WebApi.Filters;
-
-namespace Umbraco.Tests.Web.Controllers
-{
-    [TestFixture]
-    public class FilterAllowedOutgoingContentAttributeTests
-    {
-        [Test]
-        public void GetValueFromResponse_Already_EnumerableContent()
-        {
-            var userServiceMock = new Mock<IUserService>();
-            var userService = userServiceMock.Object;
-            var entityServiceMock = new Mock<IEntityService>();
-            var entityService = entityServiceMock.Object;
-
-            var att = new FilterAllowedOutgoingContentAttribute(typeof(IEnumerable<ContentItemBasic>), userService, entityService);
-            var val = new List<ContentItemBasic>() {new ContentItemBasic()};
-            var result = att.GetValueFromResponse(
-                new ObjectContent(typeof (IEnumerable<ContentItemBasic>),
-                                  val,
-                                  new JsonMediaTypeFormatter(),
-                                  new MediaTypeHeaderValue("html/text")));
-
-            Assert.AreEqual(val, result);
-            Assert.AreEqual(1, ((IEnumerable<ContentItemBasic>)result).Count());
-        }
-
-        [Test]
-        public void GetValueFromResponse_From_Property()
-        {
-            var userServiceMock = new Mock<IUserService>();
-            var userService = userServiceMock.Object;
-            var entityServiceMock = new Mock<IEntityService>();
-            var entityService = entityServiceMock.Object;
-
-            var att = new FilterAllowedOutgoingContentAttribute(typeof(IEnumerable<ContentItemBasic>), "MyList", userService, entityService);
-            var val = new List<ContentItemBasic>() { new ContentItemBasic() };
-            var container = new MyTestClass() {MyList = val};
-
-            var result = att.GetValueFromResponse(
-                new ObjectContent(typeof(MyTestClass),
-                                  container,
-                                  new JsonMediaTypeFormatter(),
-                                  new MediaTypeHeaderValue("html/text")));
-
-            Assert.AreEqual(val, result);
-            Assert.AreEqual(1, ((IEnumerable<ContentItemBasic>)result).Count());
-        }
-
-        [Test]
-        public void GetValueFromResponse_Returns_Null_Not_Found_Property()
-        {
-            var userServiceMock = new Mock<IUserService>();
-            var userService = userServiceMock.Object;
-            var entityServiceMock = new Mock<IEntityService>();
-            var entityService = entityServiceMock.Object;
-
-            var att = new FilterAllowedOutgoingContentAttribute(typeof(IEnumerable<ContentItemBasic>), "DontFind", userService, entityService);
-            var val = new List<ContentItemBasic>() { new ContentItemBasic() };
-            var container = new MyTestClass() { MyList = val };
-
-            var result = att.GetValueFromResponse(
-                new ObjectContent(typeof(MyTestClass),
-                                  container,
-                                  new JsonMediaTypeFormatter(),
-                                  new MediaTypeHeaderValue("html/text")));
-
-            Assert.AreEqual(null, result);
-
-        }
-
-        [Test]
-        public void Filter_On_Start_Node()
-        {
-            var userMock = MockedUser.GetUserMock();
-            userMock.Setup(u => u.Id).Returns(9);
-            userMock.Setup(u => u.StartContentIds).Returns(new[] { 5 });
-            var user = userMock.Object;
-            var userServiceMock = new Mock<IUserService>();
-            var userService = userServiceMock.Object;
-            var entityServiceMock = new Mock<IEntityService>();
-            entityServiceMock.Setup(x => x.GetAllPaths(It.IsAny<UmbracoObjectTypes>(), It.IsAny<int[]>()))
-                .Returns(new[] { Mock.Of<TreeEntityPath>(entity => entity.Id == 5 && entity.Path == "-1,5") });
-            var entityService = entityServiceMock.Object;
-
-            var att = new FilterAllowedOutgoingContentAttribute(typeof(IEnumerable<ContentItemBasic>), userService, entityService);
-            var list = new List<dynamic>();
-            var path = "";
-            for (var i = 0; i < 10; i++)
-            {
-                if (i > 0 && path.EndsWith(",") == false)
-                {
-                    path += ",";
-                }
-                path += i.ToInvariantString();
-                list.Add(new ContentItemBasic { Id = i, Name = "Test" + i, ParentId = i, Path = path });
-            }
-
-            att.FilterBasedOnStartNode(list, user);
-
-            Assert.AreEqual(5, list.Count);
-
-        }
-
-        [Test]
-        public void Filter_On_Permissions()
-        {
-            var list = new List<dynamic>();
-            for (var i = 0; i < 10; i++)
-            {
-                list.Add(new ContentItemBasic{Id = i, Name = "Test" + i, ParentId = -1});
-            }
-            var ids = list.Select(x => (int)x.Id).ToArray();
-
-            var userMock = MockedUser.GetUserMock();
-            userMock.Setup(u => u.Id).Returns(9);
-            userMock.Setup(u => u.StartContentIds).Returns(new int[0]);
-            var user = userMock.Object;
-
-            var userServiceMock = new Mock<IUserService>();
-            //we're only assigning 3 nodes browse permissions so that is what we expect as a result
-            var permissions = new EntityPermissionCollection
-            {
-                new EntityPermission(9876, 1, new string[]{ "F" }),
-                new EntityPermission(9876, 2, new string[]{ "F" }),
-                new EntityPermission(9876, 3, new string[]{ "F" }),
-                new EntityPermission(9876, 4, new string[]{ "A" })
-            };
-            userServiceMock.Setup(x => x.GetPermissions(user, ids)).Returns(permissions);
-            var userService = userServiceMock.Object;
-            var entityServiceMock = new Mock<IEntityService>();
-            var entityService = entityServiceMock.Object;
-
-            var att = new FilterAllowedOutgoingContentAttribute(typeof(IEnumerable<ContentItemBasic>), userService, entityService);
-            att.FilterBasedOnPermissions(list, user);
-
-            Assert.AreEqual(3, list.Count);
-            Assert.AreEqual(1, list.ElementAt(0).Id);
-            Assert.AreEqual(2, list.ElementAt(1).Id);
-            Assert.AreEqual(3, list.ElementAt(2).Id);
-        }
-
-        private class MyTestClass
-        {
-            public IEnumerable<ContentItemBasic> MyList { get; set; }
-        }
-    }
-}
diff --git a/src/Umbraco.Web.BackOffice/Filters/FilterAllowedOutgoingContentAttribute.cs b/src/Umbraco.Web.BackOffice/Filters/FilterAllowedOutgoingContentAttribute.cs
index d6863b0bef..855cd05829 100644
--- a/src/Umbraco.Web.BackOffice/Filters/FilterAllowedOutgoingContentAttribute.cs
+++ b/src/Umbraco.Web.BackOffice/Filters/FilterAllowedOutgoingContentAttribute.cs
@@ -4,15 +4,15 @@ using System.Collections.Generic;
 using System.Globalization;
 using System.Linq;
 using Microsoft.AspNetCore.Mvc;
-using Umbraco.Core.Models.Membership;
-using Umbraco.Core.Services;
 using Umbraco.Core;
 using Umbraco.Core.Models;
+using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Services;
 using Umbraco.Web.Actions;
 using Umbraco.Web.Security;
+using Umbraco.Web.WebApi.Filters;
 
-
-namespace Umbraco.Web.WebApi.Filters
+namespace Umbraco.Web.BackOffice.Filters
 {
     /// <summary>
     /// This inspects the result of the action that returns a collection of content and removes