update spec for authorization