tests for auth & non-auth