I'm curious what situations are still the most difficult when testing auth in a web app in 2024.