Added security to the sales controller spec (implementation not yet done).
I have made the assumption that the password would be passed in the http headers.  This would have been agreed with the UI developer(s) in a real world scenario
I have decided to add a make_secure method to the model to simplify the controller and to aid controller testing - rather than just adding a where condition to the controller.  Also, this keeps any SQL out of the controller which I dont like.
The password is now consistently passed as a header irrespective of creation or getting / deleting
Integration Spec was incorrectly grouped  - the GET and DELETE were being reported as being inside the POST section
Controller spec now correctly sending headers.
Implementation of sales controller now changed to add security - all controller tests passing, but the integration test is still failing, as is the sale model spec as I have not implemented find_secure yet in the model.
Corrected request spec - was not setting the password to the wrong one
Implemented the find_secure method in the sale model.  All unit tests and integration specs now working