Asked on review

Also fixed evidences_controller_spec: some of examples
were contradicting the permissions logic and only worked
because of using let_it_be and caching permissions from
previous_examples