test authenticatable api protects api type requests