test: fix tests

Security object should be created after setting super globals.

Author: kenjis

tests/system/Security/SecurityTest.php

@@ -79,13 +79,13 @@ public function testGetHashSetsCookieWhenNotPOST()
 
     public function testCSRFVerifyPostThrowsExceptionOnNoMatch()
     {
-        $security = new MockSecurity(new MockAppConfig());
-        $request  = new IncomingRequest(new MockAppConfig(), new URI('http://badurl.com'), null, new UserAgent());
-
         $_SERVER['REQUEST_METHOD']   = 'POST';
         $_POST['csrf_test_name']     = '8b9218a55906f9dcc1dc263dce7f005a';
         $_COOKIE['csrf_cookie_name'] = '8b9218a55906f9dcc1dc263dce7f005b';
 
+        $security = new MockSecurity(new MockAppConfig());
+        $request  = new IncomingRequest(new MockAppConfig(), new URI('http://badurl.com'), null, new UserAgent());
+
         $this->expectException(SecurityException::class);
         $security->verify($request);
     }
@@ -108,14 +108,14 @@ public function testCSRFVerifyPostReturnsSelfOnMatch()
 
     public function testCSRFVerifyHeaderThrowsExceptionOnNoMatch()
     {
+        $_SERVER['REQUEST_METHOD']   = 'POST';
+        $_COOKIE['csrf_cookie_name'] = '8b9218a55906f9dcc1dc263dce7f005b';
+
         $security = new MockSecurity(new MockAppConfig());
         $request  = new IncomingRequest(new MockAppConfig(), new URI('http://badurl.com'), null, new UserAgent());
 
         $request->setHeader('X-CSRF-TOKEN', '8b9218a55906f9dcc1dc263dce7f005a');
 
-        $_SERVER['REQUEST_METHOD']   = 'POST';
-        $_COOKIE['csrf_cookie_name'] = '8b9218a55906f9dcc1dc263dce7f005b';
-
         $this->expectException(SecurityException::class);
         $security->verify($request);
     }
@@ -139,14 +139,14 @@ public function testCSRFVerifyHeaderReturnsSelfOnMatch()
 
     public function testCSRFVerifyJsonThrowsExceptionOnNoMatch()
     {
+        $_SERVER['REQUEST_METHOD']   = 'POST';
+        $_COOKIE['csrf_cookie_name'] = '8b9218a55906f9dcc1dc263dce7f005b';
+
         $security = new MockSecurity(new MockAppConfig());
         $request  = new IncomingRequest(new MockAppConfig(), new URI('http://badurl.com'), null, new UserAgent());
 
         $request->setBody('{"csrf_test_name":"8b9218a55906f9dcc1dc263dce7f005a"}');
 
-        $_SERVER['REQUEST_METHOD']   = 'POST';
-        $_COOKIE['csrf_cookie_name'] = '8b9218a55906f9dcc1dc263dce7f005b';
-
         $this->expectException(SecurityException::class);
         $security->verify($request);
     }