added test that checks prevention of saving 'authId' on a player