More auth tests, fix bug