authorisation tests passing