authentication
patch to user_profile_spec and use session in set_user method in UsersController