Require login and exact HTTP methods

@rlucioni I had to remove the request factory code to ensure that the tests are exercising middleware for auth.