The change-form test set the zone on the session, which the auth middleware resets from the account on every request. The password reset test asserted BST, which stopped being London's zone name on 25 Oct. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>