add shared example - require sign in and refactored controller specs