Add spec to ensure auth is sane