remove some authorization tests, replace with controller tests, add controller tests