Actually we need to abuse the $GLOBAL['user'] for the tests, otherwise I'm not sure how to test authentication.

Core's tests actually look for success strings after posting the login form, not sure I want to go that route.