redirect if not signed in
don't check auth on root
limit auth to where it makes sense
add VCR to make tests faster
add label tests
add specs for adding prove it label
clean up the specs