This adds previously missing tests and changes the existing ones
to test the "requires_internal_auth" function directly. In order
to make the tests generic, we have a fake auth function and an
associated fixture.
Having generic tests for internal auth will make it easier to add
other "requires..." functions in future.