adds flash messages and basic drying of auth spec