Issue #2817727 by Wim Leers: Add test coverage to prove controller is called *after* authentication validation (cherry picked from commit 622deefb)