add authorization specs for non signed in users and fix strong params in users controller