added pending spec for auth with a  header on unpublished decisions