Only users can use form, list spam posts for admin

This should be defined in the controller in question, or the Post model. No reason for the User model to know about this. Since it's pretty simple, I'd recommend just putting it into the controller above, e.g.

``` ruby
@spam = Post.all.order(spam: :desc)
```

If you plan on reusing it, then I would move it into the Post model