Add specs: generated auth. tokens are unique