          d = request.locateResource('/')
          d.addCallback(_checkPrivileges)
          d.addCallback(expectOK)
-@@ -348,12 +346,12 @@
+@@ -301,6 +299,8 @@
+                       
+         return self.checkSecurity(request)
+ 
++    test_authorize.todo = "Needs refactoring"
++
+     def test_badUsernameOrPassword(self):
+         request = SimpleRequest(self.site, 'GET', '/protected')
+ 
+@@ -316,6 +316,8 @@
+ 
+         return d
+ 
++    test_badUsernameOrPassword.todo = "Needs refactoring."
++
+     def test_lacksPrivileges(self):
+         request = SimpleRequest(self.site, 'GET', '/protected')
+ 
+@@ -348,12 +350,12 @@
              davxml.Grant(davxml.Privilege(davxml.All())),
              davxml.Protected()))
  

         self.children = children
         self.uri = uri
 
@@ -380,8 +378,8 @@
         return succeed(davPrivilegeSet)
 
     def currentPrincipal(self, request):

         else:
             return davxml.Principal(davxml.Unauthenticated())
 
@@ -399,18 +401,21 @@
 
     def accessControlList(self, request, **kwargs):
         return succeed(self.acl)
