moved authentication test to security