title: What's a good way to validate access to models in controller specs?
body: <p>I have <code>Users</code> which create <code>HomeRepairTickets</code>.</p>
  
  <p><code>Firms</code> can create <code>TicketBid</code>s for <code>HomeRepairTicket</code>s they are interested in.</p>
  
  <p>Should my controller spec ensure that <code>Firm</code>s can only bid on <code>HomeRepairTicket</code>s they have access to? And make sure they can only <code>update</code> <code>HomeRepairTicket</code>s that they created? </p>
  
  <p>Or is there a better way to test appropriate authentication (eg that the ids match or that the authentication_token matches)</p>
  
  <p>I'm using <code>rspec</code>.</p>