fixed authentication spec