properly mock and test authentication