implicit auth testing