full auth test coverage