add tests for referrals and authorizations