First tests of API auth flow