additional spec coverage for authorization