setup tests for protected routes