user authentication restrictions placed on all controllers
request specs removed in favour of feature specs
users can create & delete organizations