For both posts and users, you need to test being able to edit or create.  It definitely shouldn't work at this point, due to the Rails 4 strong parameters.