Removed lazy declarations since they are no longer useful for testing
Updated test to reflect 403 on AuthZ failure rather than 401