add test case for lack of auth