all these tests seem to be testing`return {'success': False}` I'm not sure that this is really needed.  I think that maybe we need to be a bit cleverer.  It is important that the auth_code is checked but maybe we should do this in the `get_action` logic so that we always ensure that an action checked the auth at some point unless it raises an error - rather than doing all this testing.  If the auth_logic was complicated like `package_edit` then we need lots of tests but here it just seems crazy.