Issue #2817727 by Wim Leers: Add test coverage to prove controller is called *after* authentication validation