test for delegable header without an auth token
removed unncessary test prepwork
more test changes for delegation. test for when we reject an authorized request
more tests for when auth service breaks and making sure the header does not get added to passing requests