using sinon
first verification of auth