Add tests focused on authorization denial

[spkane]

We need to be extra careful that authorization requests are always denied when we expect them to be.

We should have tests that verify all these possibilities/code paths.

In general, it would be better to deny a valid request due to a mistake in the code, than to let an invalid authorization request through because some function returned nil when it shouldn't have.