add test for middleware/auth