test coverage for authorize endpoint responses