add auth and tests