spec out non-logged in user gold standard behaviour