adding files controller to show files based on permission, failing spec