added specs and cucs, also failure path for auth