added user authentication spec