fix bug; add auth test