This doesn't actually check that the user gets the tenant default. It actually looks like the user is anonymous, which isn't what I would expect.