non-published posts don't show unless admin
added published post test and added coverage gem
hid rails secret token