Add tests for invalid auth