@Test(expected = NotAuthorizedException.class)
public void rejectsXfcc_multipleCertKeysInHeader() {

  when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort);
  when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal);
  // a single header with multiple cert tags in it for the same client
  when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn(
      List.of(format("Cert=\"%s\";cert=\"%s\"", UrlEncoded.encodeString(clientPem, UTF_8),
          UrlEncoded.encodeString(clientPem, UTF_8))));
  factory.provide(request, httpServletRequest);
}