changed unauthentication to 403 Forbidden
add test for authentication