Done Auth with spec-tests (red on session create redirect!)