So we have tests to check the auth code but not for controllers. We don't have any other minitests checking the controller permissions so I am not sure it's worth the hassle of setting up the infrastructure necessary to test this just for this instance.