add scenario for non-admin attempting access
ping: rspec testing redirect protecting GET users written
pong: redirect non-admin from /users and write example for flash