code review: users controller specs