Add devise and fix specs to auth before access