    it "recognizes and generates #index" do
      { :get => "/users" }.should route_to(:controller => "users", :action => "index")
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.