tweaking auth spec