connErr := cnsmr.Close()
					Expect(connErr).To(HaveOccurred())
					Expect(connErr.Error()).To(ContainSubstring("close sent"))
				})
			})
		})
	})

	Describe("Firehose", func() {
		var (
			envelopes <-chan *events.Envelope
			errors    <-chan error
		)

		JustBeforeEach(func() {
			envelopes, errors = cnsmr.Firehose("subscription-id", authToken)
		})

		BeforeEach(func() {
			startFakeTrafficController()
		})

		Context("when connection fails", func() {
			BeforeEach(func() {
				fakeHandler.Fail = true
			})

			It("attempts to connect five times", func() {
				fakeHandler.Close()
				for i := 0; i < 5; i++ {
					Eventually(errors).Should(Receive())
			Context("single connection", func() {
				var (
					reader *consumer.Consumer
					msgs   <-chan *events.Envelope
					errs   <-chan error
				)

				JustBeforeEach(func() {
					go emitControlMessages()
					waitForControl(msgs)
				})

				BeforeEach(func() {
					reader, _ = helpers.SetUpConsumer()
					msgs, errs = reader.Firehose(generateSubID(), "")
					go readFromErrors(errs)
				})

				AfterEach(func() {
					reader.Close()
				})

				It("sends all the envelopes to the subscription", func() {
					envelopes := readEnvelopes(2*time.Second, msgs)
					Expect(verifyEnvelopes(count, envelopes)).To(BeTrue())
				})
			})

			Context("multiple connections", func() {
				var (
		Describe("FirehoseWithoutReconnect", func() {
			It("loads a token if the provided token is empty", func() {
				cnsmr.FirehoseWithoutReconnect("some-fake-app-guid", "")
				Eventually(refresher.RefreshAuthTokenCalled).Should(BeCalled())
			})

			It("loads a token if the provided token fails with 401", func() {
				testHandler.responseStatuses <- http.StatusUnauthorized
				cnsmr.FirehoseWithoutReconnect("some-fake-app-guid", "")
				Eventually(refresher.RefreshAuthTokenCalled).Should(BeCalled())
			})
		})

		Describe("Firehose", func() {
			It("loads a token if the provided token is empty", func() {
				cnsmr.Firehose("some-fake-app-guid", "")
				Eventually(refresher.RefreshAuthTokenCalled).Should(BeCalled())
			})

			It("loads a token if the provided token fails with 401", func() {
				testHandler.responseStatuses <- http.StatusUnauthorized
				cnsmr.Firehose("some-fake-app-guid", "")
				Eventually(refresher.RefreshAuthTokenCalled).Should(BeCalled())
			})
		})
	})

	Context("Synchronous", func() {
		var (
			cnsmr       *consumer.Consumer
			statuses    chan int
		It("logs recent access", func() {
			noaaConsumer.RecentLogs(APP_ID, AUTH_TOKEN)

			expected := fmt.Sprintf("CEF:0|cloud_foundry|loggregator_trafficcontroller|1.0|GET /apps/%s/recentlogs|GET /apps/%[1]s/recentlogs|0|", APP_ID)
			Eventually(testContents).Should(ContainSubstring(expected))
		})

		It("logs container metrics access", func() {
			noaaConsumer.ContainerMetrics(APP_ID, AUTH_TOKEN)

			expected := fmt.Sprintf("CEF:0|cloud_foundry|loggregator_trafficcontroller|1.0|GET /apps/%s/containermetrics|GET /apps/%[1]s/containermetrics|0|", APP_ID)
			Eventually(testContents).Should(ContainSubstring(expected))
		})

		It("logs firehose access", func() {
			noaaConsumer.Firehose("foo", AUTH_TOKEN)

			expected := "CEF:0|cloud_foundry|loggregator_trafficcontroller|1.0|GET /firehose/foo|GET /firehose/foo|0|"
			Eventually(testContents).Should(ContainSubstring(expected))
		})
	})

	Context("with legacy endpoints", func() {
		var legacyConsumer loggregator_consumer.LoggregatorConsumer

		JustBeforeEach(func() {
			tcURL := fmt.Sprintf("ws://%s:%d", localIPAddress, TRAFFIC_CONTROLLER_LEGACY_PORT)
			legacyConsumer = loggregator_consumer.New(tcURL, &tls.Config{}, nil)
		})

		AfterEach(func() {