book spec updated for http auth