ref + spec setup
add specs for auth and user