add specs for handle_unverified_request in app controller
better handle handle_unverified_request
Merge pull request #1089 from opf/fix/invalid_form_auth_token_error