Re-add auth order spec
Fixes #30220 (closed)
This was originally fixed in 8.16 and was subsequently changed starting in 9.1, reintroducing this bug. There was a test, but someone removed the test when it failed. The MR re-adds the spec that was accidentally removed. The actual fix was re-introduced in another commit.