add tests for auth_verify() failures