should there be a test with no auth?