    it "doesn't recognize #destroy" do
      { :delete => "/users/1" }.should_not be_routable
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.