Improve and add missing authoriser specs

Improved the coverage of authoriseAll and authoriseAny to ensure delayed
promise resolving is being handled. Fix authoriseAny to handle this
case.