test with auth in root.py