- The spec clicks the `Protect` button and immediately asserts on
  data in the database. Since the `Protect` button results in an AJAX
  call, we need to wait for the UI to update before running assertions.

- Also clean up the `access_levels_data` helper method. We don't need to
  use an explicit `levels` array to store changes since we're using
  `map` already.