refactor tests for 403 on protected routes instead of 302