Don't use call_action() when testing auth

It skips authorization!