test: cover require_role/require_three_legged and the enforcement-disabled path