split API specs into authenticated and unauthenticated