add auth with tests