fixup broken auth tests

Discovered that I wasn't testing `auth-user` nor was I properly testing if authentication worked.