ugh. okay, so...user error.

if your server is setting cookies and specifying the domain, your calls to client.get() needs to pass a full url, not just the path. and the domains need to match, just like for a regular browser.

for some reason i was assuming the test client would just ignore the domain rules for a browser.