Revise auth spec (broken code)