    it "recognizes and generates #destroy" do
      { :delete => "/users/1" }.should route_to(:controller => "users", :action => "destroy", :id => "1")
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.