adds controller specs for locations when theres no http basic auth