add authorization spec to reviews controller spec
fix average_rating spec and method, fix reviews_controller spec