all but 3 basic auth tests passing