Authentication testing. still need to handle redirects