Decouple auth/user tests from implementation into spec/support for reuse