It's deliberate – authorization is bypassed when `NODE_ENV === 'test'` because I didn't want to re-write every one of the other tests to require auth headers, so for the auth test the first thing I do before requiring anything is set the env to `auth-test` – that allows the suite to run, but does not prevent authorization from being implemented.