diff --git a/lib/Config/Initializer.php b/lib/Config/Initializer.php
index 4f2ceaaa60..13d95d0e3c 100644
--- a/lib/Config/Initializer.php
+++ b/lib/Config/Initializer.php
@@ -227,7 +227,7 @@ class Initializer {
   }
 
   function setupRouter() {
-    $router = new Router\Router();
+    $router = new Router\Router($this->access_control);
     $router->init();
   }
 
diff --git a/lib/Router/Router.php b/lib/Router/Router.php
index fb9ee2a207..fba4148fcb 100644
--- a/lib/Router/Router.php
+++ b/lib/Router/Router.php
@@ -16,7 +16,7 @@ class Router {
   const RESPONSE_ERROR = 404;
   const RESPONE_FORBIDDEN = 403;
 
-  function __construct($api_data = false) {
+  function __construct(AccessControl $access_control, $api_data = false) {
     $api_data = ($api_data) ? $api_data : $_GET;
     $this->api_request = isset($api_data[self::NAME]);
     $this->endpoint = isset($api_data['endpoint']) ?
@@ -28,7 +28,7 @@ class Router {
     $this->data = isset($api_data['data']) ?
       self::decodeRequestData($api_data['data']) :
       false;
-    $this->access_control = new AccessControl();
+    $this->access_control = $access_control;
   }
 
   function init() {
diff --git a/tests/unit/Router/RouterTest.php b/tests/unit/Router/RouterTest.php
index 2eca6d6649..27d1d75fc1 100644
--- a/tests/unit/Router/RouterTest.php
+++ b/tests/unit/Router/RouterTest.php
@@ -9,18 +9,18 @@ use MailPoet\Router\Router;
 require_once('RouterTestMockEndpoint.php');
 
 class RouterTest extends \MailPoetTest {
+  public $access_control;
   public $router_data;
-  public $router;
 
-  function __construct() {
-    parent::__construct();
+  function _before() {
     $this->router_data = array(
       Router::NAME => '',
       'endpoint' => 'router_test_mock_endpoint',
       'action' => 'test',
       'data' => base64_encode(json_encode(array('data' => 'dummy data')))
     );
-    $this->router = new Router($this->router_data);
+    $this->access_control = new AccessControl();
+    $this->router = new Router($this->access_control, $this->router_data);
   }
 
   function testItCanGetAPIDataFromGetRequest() {
@@ -28,7 +28,7 @@ class RouterTest extends \MailPoetTest {
     $url = 'http://example.com/?' . Router::NAME . '&endpoint=view_in_browser&action=view&data='
       . base64_encode(json_encode($data));
     parse_str(parse_url($url, PHP_URL_QUERY), $_GET);
-    $router = new Router();
+    $router = new Router($this->access_control);
     expect($router->api_request)->equals(true);
     expect($router->endpoint)->equals('viewInBrowser');
     expect($router->endpoint_action)->equals('view');
@@ -39,8 +39,8 @@ class RouterTest extends \MailPoetTest {
     $router_data = $this->router_data;
     unset($router_data[Router::NAME]);
     $router = Stub::construct(
-      new Router(),
-      array($router_data)
+      '\MailPoet\Router\Router',
+      array($this->access_control, $router_data)
     );
     $result = $router->init();
     expect($result)->null();
@@ -50,8 +50,8 @@ class RouterTest extends \MailPoetTest {
     $router_data = $this->router_data;
     $router_data['endpoint'] = 'invalid_endpoint';
     $router = Stub::construct(
-      new Router(),
-      array($router_data),
+      '\MailPoet\Router\Router',
+      array($this->access_control, $router_data),
       array(
         'terminateRequest' => function($code, $error) {
           return array(
@@ -74,8 +74,8 @@ class RouterTest extends \MailPoetTest {
     $router_data = $this->router_data;
     $router_data['action'] = 'invalid_action';
     $router = Stub::construct(
-      new Router(),
-      array($router_data),
+      '\MailPoet\Router\Router',
+      array($this->access_control, $router_data),
       array(
         'terminateRequest' => function($code, $error) {
           return array(
@@ -132,8 +132,8 @@ class RouterTest extends \MailPoetTest {
 
   function testItValidatesPermissionBeforeProcessingEndpointAction() {
     $router = Stub::construct(
-      new Router(),
-      array($this->router_data),
+      '\MailPoet\Router\Router',
+      array($this->access_control, $this->router_data),
       array(
         'validatePermissions' => function($action, $permissions) {
           expect($action)->equals($this->router_data['action']);
@@ -154,8 +154,8 @@ class RouterTest extends \MailPoetTest {
 
   function testItReturnsForbiddenResponseWhenPermissionFailsValidation() {
     $router = Stub::construct(
-      new Router(),
-      array($this->router_data),
+      '\MailPoet\Router\Router',
+      array($this->access_control, $this->router_data),
       array(
         'validatePermissions' => false,
         'terminateRequest' => function($code, $error) {