https://github.com/10gen/mongo/blob/master/jstests/auth/internal_command_auth_validation.js#L561 is running the following test

1) For a user without ['__system'] role, _shardsvrCoordinateMultiUpdate will return an Unauthorized user error.

It is not running

2) For a user with ['__system'] role, _shardsvrCoordinateMultiUpdate should not return an Unauthorized user error.

The second part is skipped in the current test. Please investigate and improve the test.

Possibly write a separate test or enhance the internal_command_auth_validation.js to enhance the verification.