more test case for auth checking
#35