Correct tests around querystring auth