added auth filter and tests