fixed auth spec