Access to these endpoints is controlled by the
Group::Security::ApplicationController, so these specs
shouldn't be shared.