tests to verify authorization works