add test to ensure private api isn't published