fixed users spec for authorization