         # Build 3 users: anon, authenticated, and authorized.
         #
         (done) =>
-          # anon
+          # anon: No session, no authentication.
           @anony = common.build_sockjs_client(done)
         (done) =>
-          # authenticated
-          session = {cookie: { maxAge: 2000 }, session_id: "authenty"}
+          # sessiony: Has session, but not authenticated.
+          session = {cookie: { maxAge: 2000 }, session_id: "sessiony"}
           @server.sockrooms.saveSession session, (err, ok) =>
-            @authenty = common.build_sockjs_client =>
-              @authenty.writeJSON {route: "identify", body: {session_id: "authenty"}}
-              @authenty.onceJSON (data) ->
-                expect(data).to.eql({route: "identify", body: {session_id: "authenty"}})
+            @sessiony = common.build_sockjs_client =>
+              @sessiony.writeJSON {route: "identify", body: {session_id: "sessiony"}}
+              @sessiony.onceJSON (data) ->
+                expect(data).to.eql({route: "identify", body: {session_id: "sessiony"}})
                 done()
         (done) =>
-          # authorized
+          # authenty: Is authenticated, but not authorized.
+          common.stubBrowserID(@browser, {email: "no_group@mockmyid.com"})
+          session = {
+            cookie: { maxAge: 2000 },
+            session_id: "authenty",
+          }
+          api_methods.authenticate session, "bogus assertion", (err, session, message) =>
+            @server.sockrooms.saveSession session, (err, ok) =>
+              @authenty = common.build_sockjs_client =>
+                @authenty.writeJSON {route: "identify", body: {session_id: "authenty"}}
+                @authenty.onceJSON (data) ->
+                  expect(data).to.eql({route: "identify", body: {session_id: "authenty"}})
+                  done()
+        (done) =>
+          # authory: Is authorized to access documents.
           common.stubBrowserID(@browser, {email: "one@mockmyid.com"})
           session = {
             cookie: { maxAge: 2000 },


  after (done) ->
    @anony.close()
    @authenty.close()
    @authory.close()
    common.shutDown(@server, done)


  it "Authorizes properly for private rooms", (done) ->
    private_join_responses = [
      [@anony, "session"], [@sessiony, "permission"],
      [@authenty, "permission"], [@authory, "success"]
    ]
    rooms = [ "dotstorm/#{@ds_private.id}", "firestarter/#{@fs_private.slug}",
              "resolve/#{@rs_private.id}",  "twinklepad/#{@tp_private.pad_id}"]
