beginning to add auth pieces, fixing up unit tests to not pollute session between tests