added a bunch of tests to membership controller spec
fixed some feature specs to work post-permissions