Expect(fakeProviderB.ExchangeCallCount()).To(Equal(1))
						_, code := fakeProviderB.ExchangeArgsForCall(0)
						Expect(code).To(Equal("some-code"))
					})

					Context("when the token is verified", func() {
						BeforeEach(func() {
							fakeProviderB.VerifyReturns(true, nil)
						})

						It("responds OK", func() {
							Expect(response.StatusCode).To(Equal(http.StatusOK))
						})

						It("verifies using the provider's HTTP client", func() {
							Expect(fakeProviderB.ClientCallCount()).To(Equal(1))
							_, clientToken := fakeProviderB.ClientArgsForCall(0)
							Expect(clientToken).To(Equal(token))

							Expect(fakeProviderB.VerifyCallCount()).To(Equal(1))
							_, client := fakeProviderB.VerifyArgsForCall(0)
							Expect(client).To(Equal(httpClient))
						})

						Describe("the ATC-Authorization cookie", func() {
							var cookie *http.Cookie

							JustBeforeEach(func() {
								cookies := response.Cookies()
								Expect(cookies).To(HaveLen(1))
								cookie = cookies[0]