[cmgbhm]

This is actually a use-case I use for interviews.

1. Everyone tests authenticated user can do the right thing.

2. Can <wrong|expired> authenticated user access the data?

3. Can an unauthenticated user access data?

If there’s a testing framework that does this scaffolding automatically, I’d love to hear it.