user authorisations attach\detach rspecs