Simplify auth tests

supertest provides a variety of ways to assert the headers and body of
the response are correct, so use those rather than doing comparisons in
the 'end' callback.