authentication spec
9.3.1 done