Add specs to cover authorization on CheckoutController