set up spec
authenticate users