tests for authorization
upgrade to express 4