Re-add auth order spec

Open Drew Blessing requested to merge auth_ominous_warning into master

Fixes #30220 (moved)

This was originally fixed in 8.16 and was subsequently changed starting in 9.1, reintroducing this bug. There was a test, but someone removed the test when it failed. The MR re-adds the spec that was accidentally removed. The actual fix was re-introduced in another commit.

Edited by Drew Blessing