add Authz unit tests, fix bugs discovered doing so.