json auth test moved to controller spec