add auth strategy, update specs for changes