pending specs for auth and passing specs for the rest