Backfill integration tests for authenticated endpoints

[ches]

Since the setup is in place for authenticated tests now, fill in the holes in the specs. RSpec metadata can be used for endpoints where authentication is optional to specify behavior of both paths:

context 'when authenticated', :authenticated do
  # ...
end