Proper test specs for authorization

[fabiante]

#88 adds user authentication. Further PRs will introduce authorization. This will need refactorings and investment into proper test specs to ensure auth works as designed.