[#2035] Further fixes to auth tests

The old auth tests are terrible in that they depend on each other to
run. Also the auth cache thing masked some bad assumptions.

The whole file should be rewritten as new tests.
[#2035] Don't use http://foo.bar as a test url

Because `.bar` is being recognized as a gTLD, it points to
`127.0.53.53`, which if you have a web server running will return
localhost (and a 200 status).

More details:

https://stackoverflow.com/questions/25662590/domain-foo-bar-points-127-0-53-53-why