Add spec
Controller methods have permissions, specs