test auth on /users endpoint