Should this use a spec-mock-thing so that accidentally doing `auth_function.asset_called_once_with()` doesn't silently pass?