Auth server creates a new session per request

Maybe this is wrong...?
test_authorize_with_expired_api_key()