this test looks wrong we should not be changing what we return here.  The auth rules may be different but externally it should behave identically.