Authorization session test contains both NamespaceString and DatabaseName objects without tenantIds, which will fail when we assert that tenantIds are provided in all commands.  Many of these tests call aggregation_request_helper::parseFromBSONForTest (which calls aggregation_request_helper::parseFromBSON) which will attempt to build an AggregateCommandRequest object that calls the deserializer.

None of these tests are gated by the multitenancy flag; they should either pass in tenantIds or be bypassed in multitenancy mode.  This may require a discussion with the Security team.