tests with fake authorization