Seems like this is already covered by test_auth_fail.