api auth unit test