updated controller specs to account for new authorizations