authentication for post actions, and post_controller specs