99768f9f

By: Michael Lynch <git@mtlynch.io>

Decouple auth flow tests from rate limiter

Use a fake handler authenticator in auth flow tests so they exercise handler behavior without constructing the shared-secret authenticator or concrete rate limiter.