Adding a spec to verify AuthN/AuthZ

This particular spec came about as a promise to a senior depositing
something. She marked her Senior Thesis as "Open Access with Embargo".
However, when she logged out (via CAS), she could still view her Senior
Thesis.

As it turns out, logging out of CAS does not truly log you out of the
session, at least until you close your browser. Then you are fully
logged out.

I will be working on a future solution to address this behavior, as it
presently violates the principle of least surprise.