move audit specs to requests/lib/controller

Move these out of features, because the specific logic can be tested in isolation.