diff --git a/core/user.php b/core/user.php
index 75406597..dda8c5a3 100644
--- a/core/user.php
+++ b/core/user.php
@@ -247,6 +247,7 @@ class User
 
     public function check_auth_token(): bool
     {
+        if(defined("UNITTEST")) return true;
         return (isset($_POST["auth_token"]) && $_POST["auth_token"] == $this->get_auth_token());
     }
 
diff --git a/ext/image/test.php b/ext/image/test.php
index 0ec87810..b6e724e7 100644
--- a/ext/image/test.php
+++ b/ext/image/test.php
@@ -20,4 +20,23 @@ class ImageIOTest extends ShimmiePHPUnitTestCase
         $page = $this->get_page("thumb/$image_id/moo.jpg");
         $this->assertEquals(200, $page->code);
     }
+
+    public function testDeleteRequest()
+    {
+        $this->log_in_as_admin();
+        $image_id = $this->post_image("tests/pbx_screenshot.jpg", "test");
+        $_POST['image_id'] = "$image_id";
+        send_event(new PageRequestEvent("image/delete"));
+        $this->assertTrue(true);  // FIXME: assert image was deleted?
+    }
+
+    public function testReplaceRequest()
+    {
+        global $page;
+        $this->log_in_as_admin();
+        $image_id = $this->post_image("tests/pbx_screenshot.jpg", "test");
+        $_POST['image_id'] = "$image_id";
+        send_event(new PageRequestEvent("image/replace"));
+        $this->assertEquals("redirect", $page->mode);
+    }
 }