add test for user auth before action