added more oauth specs, added missing user controller spec