Fixed security tests: added authorize attributes; some controllers added to exceptions