Codeception with PhpBrowser seems to not be following redirects
Turns out this was caused by the fact that Ion Auth uses a "Reload" header instead of a "Location" header for it's redirects. For some reason Codeception (or perhaps the underlying PhpBrowser) is not obeying that form of redirect. If I change it to a "Location" header redirect, the test passes.
I've started another issue for figuring out why the "Reload" redirect does not work. You can find it here: Why doesn't Codeception's PhpBrowser follow a "Reload" header?