scaffold session auth spec