API tests
working login and enforcement on root