Add tests to ensure non authenticated requests get 401