testing "before" and "auth"