improved tests

* added a ip-is-auth-free subdomain