@Test(expected = NotAuthorizedException.class)
public void invalidSessionCookie() throws Exception {

  Cookie badSessionCookie = new Cookie("session", "bad-value");
  cookies.put(badSessionCookie.getName(), badSessionCookie);
  when(cookieAuthenticator.authenticate(badSessionCookie)).thenReturn(Optional.empty());
  factory.provide(request);
}