Test that authentication blocks un-authenticated POST access.