test(auth): cover the lock itself and its expiry, not just the counter (#3624 follow-up)

test(auth): cover the lock itself and its expiry, not just the counter (#3624 follow-up) #10012