api/auth/auth_test: cover non-standard client errors, cover authenticated user and session context