basic user auth plus validation specs