separated tests for authentication failures