Add tests around authorization