specs & scenarios for authentication redirects