[WIPAdd test for malicious resource acquisition

I was thinking about it this morning, but I think the fact that we bypass the controller interface opens up for a big security leak. In particular, `before_action`, etc won't be honored. This would allow a malicious, or inattentive user to pass in a URL and obtain a resource he should not have access to. I wrote a spec to document this behavior.