extract common FakeRequst stuff in AuthSpec to separate function