test the create hit method, ignore the credentials