Is it possible to test authentications by setting the `remote_user` header? If that's the case, we can get some better coverage here if we aren't testing it elsewhere.