This is handled below. This test is fine as-is since the authz check is indeed a "validation" check, while more advanced permissions checks are different.