add tests on authentication