I think we should keep authorization failure paths to controller specs. Keeps the suite a little faster and keeps the integration specs focused on success paths.