testing authorization for reviews controller