add spec for authentication failed