specs for controller with cancan. redirect to root if forbidden