Tests that an authenticated API request creates a server-side audit event without changing the database.