add tests for auth