controller actions authorization and feature spec refactoring