rewrite mocha tests given concurrency issues

tests have been problematic with phantom caching of objects between tests that should be torn down. Running all tests individual as an example gives us the 401 and 403 in the right spots. however, run the full suite remnant 403's fall into code paths werhere 401 is expected. and vica versa.

So, plan is to remove supertest and rewrite/cleanup the tests as needed.

Start by running the tests individually and as the full suite to reproduce the incorrect 401 and 403 paths, then inspect the existing Mocha tests and their Supertest usage. Review the test teardown and caching behavior; done means the tests no longer depend on shared state and the full suite reports 401 and 403 responses in the expected cases.

Written by the indexing model from the issue text.