test(api): add tests for auth