updated spec to reflect authentication scheme