[auth] test emptyblob http reads instead of /status
[auth] test emptyblob http reads instead of /status

This is a more realistic test.

Maybe we should always allow read access to /status?

buchgr/bazel-remote,buchgr/bazel-remote