The changes to fcrepo-auth-common (which appear first in the diff below) are to compensate for the fact that version creation makes new child objects whose names are out of our control and that test was based around the names of nodes. I've updated that test to retain its spirit but still work in the case where version nodes are created. I've also added an issue to look into a more intuitive and comprehensive approach for minimizing the confusion associated with this behavior.