expect instead of allow in controller tests