more tests for auth: SSO