testing authentication with api controllers