tests for authenticate (although not for the success case)