Move CORS authenticator test to non-private tests