basic authentication is in place with tests and session