prepared authentication
fixed model specs; controller/request-specs are still failing