mostly redundant to authopt_fuzz, but it's sensitive code so IMO it makes sense to test this layer too