add tests for authorization