You should also have specs for the following scenarios:

* Unauthenticated user tries to edit review
* Authenticated user doesn't provide all the required fields