add tests for post /widgets/x and get /events
add tests to confirm that auth tokens are required