The authorization shouldn't be delegated to the model.
Remove bson dependency; it was required by MongoDB.
Convert specs to RSpec 3.0.0.beta2 syntax with Transpec

This conversion is done by Transpec 1.10.4 with the following command:
    transpec -f

* 63 conversions
    from: obj.should
      to: expect(obj).to

* 25 conversions
    from: == expected
      to: eq(expected)

* 22 conversions
    from: obj.should_not
      to: expect(obj).not_to

* 3 conversions
    from: be_true
      to: be_truthy

* 3 conversions
    from: obj.should_receive(:message)
      to: expect(obj).to receive(:message)

* 3 conversions
    from: be_false
      to: be_falsey

* 3 conversions
    from: obj.stub(:message => value)
      to: allow(obj).to receive_messages(:message => value)
Remove 'should' from spec descriptions.