rspec, and secure_token