removed user getter/setter; exposed public method on oauth1/oauth2
updated auth spec for more test coverage