we stub all the authentication, there is also a check for current_user btw. So logged in but without key should be good to go. Maybe we need to add a spec for that to be sure.