This test (and several others) will not be safe when multiple browsers hit the server at once (which is a real use case for us).

Not sure how to do this safely, give the current API with a global key state.

Need to think on this more.