add controller tests for user authentication