all auth tests pass