add tests for user.auth