add auth with tests

Doesn't look like we need this before. Generally, `before` doesn't have assertions in it.