more rspec tests for authorization