    it "doesn't recognize #index" do
      { :get => "/users" }.should_not be_routable
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.