I do not understand why you are doing things this way--it makes it much more complicated to follow, and I wonder if OpenMRS is caching privileges somewhere when you log in.

Please just set up the user _exactly how you want it_ in the xml file, i.e. in the xml you should _not_ grant the Add Patients privilege.

The test should be as simple as:
```
executeDataSet(...)
Context.authenticate(...)
handle(newPostRequest(...))
```
and it should expect ContextAuthenticationException.