api auth test: 'should' is more expressive than 'test'