Test that all methods require authentication

and move authentication to before callback.