changed spec to accept authorization, added authorization with devise