add test case for auth hash urls