> It is important that the auth_code is checked but maybe we should do this in the 
> get_action logic so that we always ensure that an action checked the auth at some point > unless it raises an error - rather than doing all this testing. 

I'd be happy with somehow testing or ensuring that all action functions call their auth functions, *if* we then had *unit* tests of the auth functions, that work by calling the auth functions directly (and those unit tests would be much like the ones I have here, i.e. tests for each invalid input and failure condition: test that group member cannot purge, test the group admin cannot purge...) My reason for wanting the unit tests is that it's important that the auth function is called, but it's also important that the auth function does what it's supposed to do. Moving them to unit tests would avoid so many simulated HTTP requests to do all this via functional testing, so it might make the tests a bit faster.