auth behavior tests are working with tweaking