authentication specs