add obj passing and route matching to spec

Now the spec defines that you can optionally pass:
- `username:password` string
- an object with `user` and `pass` keys
- or globstar matchers keys and `username:password` values

/cc @jenius @joshrowley