update specs and controller to deal with scoped users [#4]