simplified feature specs, added more tests and added message for a blank...

... list
When fixing that earlier security bug that was patched with the user-scoped queries, here is where I ought to have advised putting a spec to expose the issue.