add tests for password authentication