added test for devise and guests that they shouldn't have access to the app