@Test(expected = NotAuthorizedException.class)
public void rejectsXfcc_disallowedPortWithHeader() {

  when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn(
      List.of(xfccHeader));
  when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal);
  when(httpServletRequest.getLocalPort()).thenReturn(xfccDisallowedPort);
  factory.provide(request, httpServletRequest);
}