add tests for disable auth