authentication spec, no integration tests