Updated test to expect 'User not authorized'