Don't allow logins with blank remember_token

* Rename denies_controller_spec.rb -> permissions_controller_spec.rb
* Fixes #333