Auth specs
remove HTTP tests (needs work)