finished auth spec