Failing test for cross-scope CSRF invalidation

Confirming @markedmondson's issue #2640.