add tests for auth decorator