setting up
add before filter to authorize
spec guest permissions
spec admin permissions
merging