Specs for GET method in different authorization contexts