The tests were doing erroneous comparisons:

• assertThat(tokenClientTwo).isEqualTo(tokenClientTwo); (2x tokenClientTwo)
• #equal was invoked on mocks and therefore wasnt using the real implementation in the auth strategies