test auth routes and redirects