refactor permission specs and module

- change 'not true' to 'false'
- add boolean method for 'allow_all'
tested controller additions