add spec for admin and guest authentication