fixing strangeness in authorisation test. It returned spurious 403s