authorization tests working