update user spec to use factory and rework authentication to use arel query