make methods/spec work with user authorization