Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

test(session,basic): pin foreign authentication results, name user-ids

session.Authenticator.Authenticate returns security.Anonymous() when it
does not support the authentication it gets, but no test told that
return value from its input: the test passed security.Anonymous() itself.
It now passes a value of another type and asserts the anonymous result,
with the generated PrincipalLoader mock (never called) in place of the
hand-written loader.

The breaking note on format and separator characters named passwords
only: a user-id holding one — a Persian or Indic name written with
ZERO WIDTH NON-JOINER U+200C or ZERO WIDTH JOINER U+200D — is refused
too. CHANGELOG, MIGRATION, LIMITATIONS and the security considerations
now say so, with its remedy: rename the account or give it an alias.

Audit: CORE-11, CORE-15.