adapt auth session spec to reworked version