controller specs now working with stubbed authentication