auth token specs passing now