Divided authentication and user controllers and specs