add tests for h.auth.utils