title: How can I use RSpec to test the response code on a CanCan failed authorization?
body: <p>I'm working on a rails project in which I use CanCan to authorize my resources. When a user is not signed in and tries to submit a "talk" (via an ajax form submission), CanCan correctly raises a 401 with <code>{"status":"error","message":"You must be logged in to do that!"}</code> as the response (I have verified this in the browser using firebug). However, in my tests get a 302 response code rather than a 401:</p>
  
  <pre><code>class TalksController &lt; ApplicationController
    authorize_resource
  
    def create
      @talk = current_user.talks.build(params[:talk])
  
      respond_to do |format|
        if @talk.save
          response = { :redirect =&gt; talk_path(@talk) }
          format.html { redirect_to @talk, notice: 'Talk was successfully created.' }
          format.json { render json: response, status: :created,  }
        else
          format.html { render action: "new" }
          format.json { render json: @talk.errors, status: :unprocessable_entity }
        end
      end
    end
  end
  </code></pre>
  
  <p>talks_controller_spec.rb:</p>
  
  <pre><code>describe TalksController do
    describe "POST create" do
      context "when not signed in" do
        it "should not assign talk" do
          post :create
          assigns[:talk].should be_nil
        end
        it "should respond with a 401" do
          post :create
          response.response_code.should == 401
        end
      end
    end
  end
  </code></pre>
  
  <p>The first example included here is successful (assigns[:talk] does not get assigned), but the second is not:</p>
  
  <pre><code>1) TalksController POST create when not signed in should respond with a 401
       Failure/Error: response.response_code.should == 401
         expected: 401
              got: 302 (using ==)
       # ./spec/controllers/talks_controller_spec.rb:53:in `block (4 levels) in &lt;top (required)&gt;'
  </code></pre>
  
  <p>I'm not sure exactly what's going on. Is there a way I can test for the actual response code returned to the browser? Or a better way I can test the authorization?</p>