added test for no auth