use a before_action to test auth

Use a before_action to test authorization instead of decorating
controller methods with the auth test methods