[WIP] Add test for malicious resource acquisition

I was thinking about it this morning, but I think the fact that we bypass the controller interface opens up for a big security leak. In particular, `before_action`, etc won't be honored. This would allow a malicious, or inattentive user to pass in a URL and obtain a resource he should not have access to. I wrote a spec to document this behavior. 
Why add "should"? Since its an assertion it seems wishy washy to say "should". Just assert "it honors controller callbacks."

Thinking of specs descriptions as requirements makes it easy to figure out how the wording should be. I'm definitely guilty of violating this, but it is something to strive for.