adds controller specs for receiving a 401 response code when hitting without http basic authing