tiny FT to check pre-authorisation hack works