testing auth decorator