auth mocked, get-current-user works