move authorize tests in own package