auth implemented with tests