Add missing review controller spec and user authentication to review controller