revise user spec to fit oauth