continuing to chase down subtle 401 vs 403 authentication test issues
impersonating fail user with webui fails