removed XXX notes from grant statements in model specs
factored out authenticates_user to shared_examples