Tests for responses

closes #199
Since this is a json api, you should return a `403` error instead of a flash and redirect http://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses