added test for auth failure