add spec to deny new action when signed in