test tornado auth