fixed test bugs, added auth header