My login works, but I want tests for the auth edge cases that turn into security issues or support tickets. Write tests covering: 1. Session expiry: an expired session or token is rejected, and the user is redirected to login rather than shown a broken page. 2. Logout: after logout, the old session or token no longer works, even if replayed. 3. Password reset: a reset link works once and only once, expires after its window, and an old reset link can't be reused after a newer one was issued. 4. Magic links or email confirmation tokens (if my app has them): single use, correct expiry, and they can't be used for a different account than they were issued to. 5. Brute force protection: repeated failed logins trigger whatever rate limiting or lockout my app is supposed to have. If it has none, flag that as a finding instead of writing a test that documents the hole. 6. Token tampering: a modified or forged token is rejected, not partially accepted. Assert response codes and user-facing behavior, not internal implementation details. Don't weaken security checks to make tests pass. If a test fails because the auth logic is genuinely broken, stop and show me the failure before touching the implementation. When done, run the suite and give me a list of which protections are verified and which are missing entirely.