Improved specs for authorization controller