add test for case of no auth