finish user authentication spec