diff --git a/authn/authenticate_internal_test.go b/authn/authenticate_internal_test.go
index 305c0af58..57d7dd846 100644
--- a/authn/authenticate_internal_test.go
+++ b/authn/authenticate_internal_test.go
@@ -374,6 +374,7 @@ func TestGetGroups(t *testing.T) {
 		}
 		fmt.Fprintf(w, "%s", body)
 	}))
+	defer srvNext.Close()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		body, err := json.Marshal(
 			Groups{
@@ -391,6 +392,7 @@ func TestGetGroups(t *testing.T) {
 		}
 		fmt.Fprintf(w, "%s", body)
 	}))
+	defer srv.Close()
 	a.groupEndpoint = srv.URL
 
 	for name, test := range map[string]struct {
diff --git a/http_handler_internal_test.go b/http_handler_internal_test.go
index c9a30be2f..f496cf492 100644
--- a/http_handler_internal_test.go
+++ b/http_handler_internal_test.go
@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"encoding/hex"
 	"encoding/json"
+	"fmt"
 	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
@@ -17,7 +18,6 @@ import (
 
 	"github.com/golang-jwt/jwt"
 	"github.com/molecula/featurebase/v3/authn"
-	"github.com/molecula/featurebase/v3/vprint"
 	"golang.org/x/oauth2"
 
 	"github.com/molecula/featurebase/v3/authz"
@@ -191,12 +191,42 @@ func readResponse(w *httptest.ResponseRecorder) ([]byte, error) {
 func TestAuthentication(t *testing.T) {
 	type evaluate func(w *httptest.ResponseRecorder, data []byte)
 	type endpoint func(w http.ResponseWriter, r *http.Request)
+
+	type Group struct {
+		GroupID   string `json:"id"`
+		GroupName string `json:"displayName"`
+	}
+
+	// Groups holds a slice of Group for marshalling from JSON
+	type Groups struct {
+		NextLink string  `json:"@odata.nextLink"`
+		Groups   []Group `json:"value"`
+	}
+
+	groupSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, err := json.Marshal(
+			Groups{
+				Groups: []Group{
+					{
+						GroupID:   "what are you?",
+						GroupName: "i am a carbon-based bipedal life form descended from an ape",
+					},
+				},
+			},
+		)
+		if err != nil {
+			t.Fatalf("unexpected error marshalling groups response: %v", err)
+		}
+		fmt.Fprintf(w, "%s", body)
+	}))
+	defer groupSrv.Close()
+
 	var (
 		ClientId         = "e9088663-eb08-41d7-8f65-efb5f54bbb71"
 		ClientSecret     = "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF"
 		AuthorizeURL     = "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/authorize"
 		TokenURL         = "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/token"
-		GroupEndpointURL = "https://graph.microsoft.com/v1.0/me/transitiveMemberOf/microsoft.graph.group?$count=true"
+		GroupEndpointURL = groupSrv.URL
 		LogoutURL        = "https://login.microsoftonline.com/common/oauth2/v2.0/logout"
 		Scopes           = []string{"https://graph.microsoft.com/.default", "offline_access"}
 		SecretKey        = "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF"
@@ -684,11 +714,11 @@ func TestChkAuthN(t *testing.T) {
 			test.handler(w, r)
 			resp := w.Result()
 			body, err := ioutil.ReadAll(resp.Body)
+			defer resp.Body.Close()
 			if err != nil {
 				t.Fatal(err)
 			}
 			if !strings.HasPrefix(string(body), test.err) {
-				vprint.VV("body: %s", body)
 				t.Fatalf("expected error %s, got: %s", test.err, string(body))
 			}
 		})