Sets protect redirect default to true

* Adds tests for auth.protect
* Adds tests for auth.allowOrigin
Uses auth.protect() redirect default