updated tests to match the default of not allowing hostbased auth