Refactoring org reports controller jon

I've done some simplification of the controller extension (removing permissions to avoid doubling up on the admin check) and also created a unit test that tests the extension completely independently of rails (although contains more mocking and stubbing).  In principle the controller spec could now be deleted?  Although I think it is interesting to reflect what the three different specs (acceptance, controller and unit) buy us and which combinations we should prefer.

My main concerns are that the controller specs get very long and are difficult to maintain.  Maintenance difficulty is also an issue with the unit test, but at least it is more specifically targeted, so that when and if one wants to work on changing the controller extension then it's clear where the tests are for that.  Perhaps the unit test would be improved by using the new rspec features that allow doubles to be tracked, e.g. we could be creating a mock controller that is at least loosely linked to the existing controllers, although that maybe defeats the separation mantra ...