Should this always revert to false after one call? Are there tests where we would want this to challenge multiple times, to test an auth fail?