[GoblinSlayer]

Authorization sadness is just hidden under complexity and you don't suspect anything until a breach. It needs xfail tests, but who writes them?