extended testing to include authorisation