fixed up http strategy specs, and also changed usersessions function to authorized