use 2.4 style auth in test
be sure that we are not bypassing auth
refactor auth + test using 2.4 rolebased auth