@Test(expected = NotAuthorizedException.class)
public void rejectsXfcc_multipleHeaderEntries() {

  when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort);
  when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal);
  // a single header with multiple client elements in to it
  when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn(
      List.of(xfccHeader + "," + xfccHeader));
  factory.provide(request, httpServletRequest);
}