improve auth
add auth test