add test for authentication and authorization