updated authentication spec