update test - sending auth in the headers is enough