Spec posts controller
Limit unauthorised users' access to visiting unpublished posts
Security fix for json