wrote more comprehensive tests for auth and user api