Is this test actually testing something that can fail without your code? You should probably create a few groups with one user and call `group_list_authz` with a different user.