@Test
  public void testPing() {
    assertResponse(restClient.doHEAD("/ping", "stranger", "stranger"))
        .hasStatusCode(200);
    assertResponse(restClient.doGet("/ping", "stranger", "stranger"))
        .hasStatusCode(200);

    assertResponse(restClient.doHEAD("/ping", "data", "data"))
        .hasStatusCode(200);
    assertResponse(restClient.doGet("/ping", "data", "data"))
        .hasStatusCode(200);
  }
This test should always return an OK, whether the user is known or unknown. A phishing script
should not be able to determine whether a user/password combination is good
geode-assembly/src/integrationTest/java/org/apache/geode/rest/internal/web/RestSecurityIntegrationTest.java