add sessions spec and create spec for auth tokens