Added spec for unauthenticated flow

to verify that authentication is actually required