Move unauthorized request from comments spec to shared