add test for user authorization