add spec for authentication controller