update the spec to remove hardcoded auth token