authentication and sessions spec complete