lol.... Adding an rspec test to verify permissions on a controlller action is doable in a PR.  So, I have to disagree.  As a product, I'd view it as important that rbac is verified; otherwise, a user without permissions could do things they shouldn't (if there were a bug in the code).  But, seeing as how the PR has been merged w/o resolution, we'll address it in a separate PR.

Adding the infastructure to minitest to better allow it to test things we commonly do in rspec can be discussed outside of the scope of the PR.  To a small extent that has begun.  I raised it with Mike earlier this week and I suspect that we'll be adding some time to address some of those areas.