How should we handle testing events or expected exceptions such as security or business rule violation?