testing onsite auth