test(auth): added server-side auth tests