Add: user_roles spec, controller specs